c1a4448bea3bc8f763bb8a55ed0419e1564f117763db23a7cb1045a493883e49

Analysis

max time kernel
140s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CJ_ZJJJS_BX2.1/ExamBible.exe
Size

1.4MB
MD5

f2514dca923340fc8d7684ec842d3fba
SHA1

0f6e27e37b7abb92947b4174332f8de635a3ab12
SHA256

238b1a66ed9966cf4a3d4af0f81d7daac7e98bc14836a4dad218e1a41d0ed276
SHA512

81d7e7d56f958e8c9898c8e64124009c07dc8747a05adfd467415cdf0387aaf20b0c8024f3dd90ab78b437d0b0f2e4fc59ed95dfbb874aae59c7ead9f45cb254
SSDEEP

24576:b1NVNQDGHmSupJURxLJsZ+Vh/sfZ05efWvG2uH3dIO+FoxY9h:pX6GzupJURxLJsS/mZ05gx2uHSO+FoK

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ExamBible.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExamBible.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ExamBible.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ExamBible.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\IESettingSync	ExamBible.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	ExamBible.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\FLAGS\ = "0"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CJ_ZJJJS_BX2.1\\MIDAS.DLL"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CJ_ZJJJS_BX2.1"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DatapacketWrite.1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib\ = "{83F57D68-CA9A-11D2-9088-00C04FA35CFA}"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1\Clsid\ = "{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1\ = "Borland Midas DatapacketRead"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1\Clsid	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DatapacketRead.1"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1\Clsid\ = "{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib\ = "{83F57D68-CA9A-11D2-9088-00C04FA35CFA}"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1\Clsid	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\ = "Borland Midas DSCursor Current"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1\Clsid	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DatapacketRead"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ = "IAppServer"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\ = "Borland Midas DSBase Current"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\CurVer	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\CurVer\ = "Borland.Midas_DSCursor.1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1\ = "Borland Midas DatapacketWrite"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DatapacketWrite"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\ = "Borland Midas type library"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\Clsid\ = "{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\ProgID	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1\Clsid\ = "{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ProxyStubClsid32	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\FLAGS	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1\ = "Borland Midas DSBase 1"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CJ_ZJJJS_BX2.1\\MIDAS.DLL"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1\Clsid	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\ProgID	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ = "IAppServer"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CJ_ZJJJS_BX2.1\\MIDAS.DLL"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\HELPDIR	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib\Version = "1.0"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DSCursor 1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1\Clsid\ = "{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\ProgID	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1\ = "Borland Midas DSCursor 1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\0	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\Clsid\ = "{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID\ = "Borland.Midas_DSCursor"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CJ_ZJJJS_BX2.1\\MIDAS.DLL"	ExamBible.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2852	ExamBible.exe
2852	ExamBible.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2852	ExamBible.exe
2852	ExamBible.exe
2852	ExamBible.exe
2852	ExamBible.exe
2852	ExamBible.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	ExamBible.exe
2852	ExamBible.exe

C:\Users\Admin\AppData\Local\Temp\CJ_ZJJJS_BX2.1\ExamBible.exe
"C:\Users\Admin\AppData\Local\Temp\CJ_ZJJJS_BX2.1\ExamBible.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CJ_ZJJJS_BX2.1\Menu\Test.html

Filesize
246KB

MD5
fe8ff213cc13ae469ce718658ddf08a3

SHA1
7d71c0c527f596771c86d36d5ab571023e8b8e88

SHA256
c65a9747c08845f57cd1dbb5c580f4ede368b92f3b31ea95d2476716179bcde8

SHA512
d68050edbfc1d269f6156d364a827fb3ecdc5dffd77a852cc72546709c1e54b5d616a3639afd3340329ac7ba61d0983435a76c95e02f87dc4d61f2a1e881d5bb

Download Submit
memory/2852-8-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-3-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-11-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-5-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-0-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/2852-7-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-6-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-10-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-2-0x0000000000693000-0x0000000000695000-memory.dmp

Filesize
8KB

Download
memory/2852-9-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-13-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-4-0x00000000027B0000-0x00000000028F0000-memory.dmp

Filesize
1.2MB

Download
memory/2852-14-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/2852-15-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/2852-1-0x00000000001F0000-0x00000000001FB000-memory.dmp

Filesize
44KB

Download
memory/2852-22-0x0000000000693000-0x0000000000695000-memory.dmp

Filesize
8KB

Download
memory/2852-23-0x000000004DAE0000-0x000000004DB31000-memory.dmp

Filesize
324KB

Download
memory/2852-24-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/2852-30-0x000000004DAE0000-0x000000004DB31000-memory.dmp

Filesize
324KB

Download