Analysis

  • max time kernel
    141s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2024, 00:40

General

  • Target

    BadCopyEng.exe

  • Size

    634KB

  • MD5

    0a75cdf1935a1eb1e03a1a431e16e47e

  • SHA1

    fdf610ac52b02bafa022462fec68233307f4769a

  • SHA256

    c2556d888dafa5b1eb4bf8d633f8c140a8b926f01f258b32a61adaa7e6c52ecc

  • SHA512

    9ff810927dcabac860e1a738cfd94f30ca4d6c8b6964bfc906a46aa6256bea2e2118e8ffb65fe13dbbebff2512664aaec4a857f463abd25153fc52c69079adf0

  • SSDEEP

    12288:VCCVrX1Yld/kQ9EEOUhBafcfoIbZej9SCTEYQ6b7MP+Dd2d:VCCVrihRrl2WyjTTBx7MP+h2d

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies registry class 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BadCopyEng.exe
    "C:\Users\Admin\AppData\Local\Temp\BadCopyEng.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    PID:2152

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2152-0-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-1-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-2-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-3-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-4-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-5-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-6-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-7-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-8-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-9-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-10-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-11-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-12-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-13-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-14-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-15-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-16-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-17-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-18-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB

        • memory/2152-19-0x0000000000400000-0x0000000000C21000-memory.dmp

          Filesize

          8.1MB