Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10-11-2024 00:25

General

  • Target

    popr.exe

  • Size

    710KB

  • MD5

    97a31177f4a5e152e33871ec91ae35c1

  • SHA1

    be8af16657b19efe99c8440e8cf670ae9c1dc481

  • SHA256

    44a2cebee9b83f1bb385f7b6f18bc4c8c05262ad33f804a2de16f5d60c432f7f

  • SHA512

    bca7e50e2f54487e2bf95d393445b7fc8f2c3ab372d4038dc3c731391565288963ef3f8a4810558eaeccfc381df52565f96385fb50d361910d857aabe808019d

  • SSDEEP

    12288:1xbGshVF+x0qVp0X3LYNGzJyhvQ54rvPRu6b7MP+Dd2nph0viDr9zeM6lD:1Zfh2xVp0XWeJyq5wPh7MP+h2npKv4GD

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\popr.exe
    "C:\Users\Admin\AppData\Local\Temp\popr.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2960-1-0x00000000003C0000-0x00000000003F0000-memory.dmp

    Filesize

    192KB

  • memory/2960-0-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-50-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

    Filesize

    4KB

  • memory/2960-49-0x0000000002A80000-0x0000000002A81000-memory.dmp

    Filesize

    4KB

  • memory/2960-51-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

    Filesize

    4KB

  • memory/2960-62-0x00000000021F0000-0x00000000021F1000-memory.dmp

    Filesize

    4KB

  • memory/2960-61-0x00000000021E0000-0x00000000021E1000-memory.dmp

    Filesize

    4KB

  • memory/2960-60-0x0000000001E40000-0x0000000001E41000-memory.dmp

    Filesize

    4KB

  • memory/2960-59-0x0000000002190000-0x0000000002191000-memory.dmp

    Filesize

    4KB

  • memory/2960-58-0x0000000002180000-0x0000000002181000-memory.dmp

    Filesize

    4KB

  • memory/2960-63-0x0000000001E80000-0x0000000001E81000-memory.dmp

    Filesize

    4KB

  • memory/2960-57-0x0000000000780000-0x0000000000781000-memory.dmp

    Filesize

    4KB

  • memory/2960-56-0x0000000002B10000-0x0000000002B11000-memory.dmp

    Filesize

    4KB

  • memory/2960-55-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

    Filesize

    4KB

  • memory/2960-54-0x0000000002B00000-0x0000000002B01000-memory.dmp

    Filesize

    4KB

  • memory/2960-53-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

    Filesize

    4KB

  • memory/2960-52-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

    Filesize

    4KB

  • memory/2960-35-0x0000000002A70000-0x0000000002A71000-memory.dmp

    Filesize

    4KB

  • memory/2960-34-0x0000000002A50000-0x0000000002A51000-memory.dmp

    Filesize

    4KB

  • memory/2960-33-0x0000000002A30000-0x0000000002A31000-memory.dmp

    Filesize

    4KB

  • memory/2960-32-0x0000000002A40000-0x0000000002A41000-memory.dmp

    Filesize

    4KB

  • memory/2960-31-0x0000000002A10000-0x0000000002A11000-memory.dmp

    Filesize

    4KB

  • memory/2960-30-0x00000000029F0000-0x00000000029F1000-memory.dmp

    Filesize

    4KB

  • memory/2960-29-0x00000000029D0000-0x00000000029D1000-memory.dmp

    Filesize

    4KB

  • memory/2960-28-0x00000000029B0000-0x00000000029B1000-memory.dmp

    Filesize

    4KB

  • memory/2960-27-0x0000000002990000-0x0000000002991000-memory.dmp

    Filesize

    4KB

  • memory/2960-26-0x00000000027E0000-0x00000000027E1000-memory.dmp

    Filesize

    4KB

  • memory/2960-25-0x0000000002980000-0x0000000002981000-memory.dmp

    Filesize

    4KB

  • memory/2960-24-0x00000000027C0000-0x00000000027C1000-memory.dmp

    Filesize

    4KB

  • memory/2960-23-0x00000000027A0000-0x00000000027A1000-memory.dmp

    Filesize

    4KB

  • memory/2960-22-0x0000000002780000-0x0000000002781000-memory.dmp

    Filesize

    4KB

  • memory/2960-21-0x0000000002790000-0x0000000002791000-memory.dmp

    Filesize

    4KB

  • memory/2960-20-0x0000000002760000-0x0000000002761000-memory.dmp

    Filesize

    4KB

  • memory/2960-19-0x0000000002770000-0x0000000002771000-memory.dmp

    Filesize

    4KB

  • memory/2960-18-0x0000000002740000-0x0000000002741000-memory.dmp

    Filesize

    4KB

  • memory/2960-17-0x0000000002720000-0x0000000002721000-memory.dmp

    Filesize

    4KB

  • memory/2960-16-0x0000000002730000-0x0000000002731000-memory.dmp

    Filesize

    4KB

  • memory/2960-15-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/2960-14-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2960-13-0x00000000001F0000-0x00000000001F5000-memory.dmp

    Filesize

    20KB

  • memory/2960-12-0x0000000002690000-0x0000000002692000-memory.dmp

    Filesize

    8KB

  • memory/2960-11-0x00000000025D0000-0x00000000025D2000-memory.dmp

    Filesize

    8KB

  • memory/2960-10-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB

  • memory/2960-8-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB

  • memory/2960-7-0x0000000002200000-0x0000000002201000-memory.dmp

    Filesize

    4KB

  • memory/2960-6-0x00000000021D0000-0x00000000021D1000-memory.dmp

    Filesize

    4KB

  • memory/2960-5-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/2960-4-0x0000000002170000-0x0000000002172000-memory.dmp

    Filesize

    8KB

  • memory/2960-3-0x0000000002140000-0x0000000002141000-memory.dmp

    Filesize

    4KB

  • memory/2960-2-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2960-48-0x0000000002A60000-0x0000000002A61000-memory.dmp

    Filesize

    4KB

  • memory/2960-47-0x0000000002A20000-0x0000000002A21000-memory.dmp

    Filesize

    4KB

  • memory/2960-46-0x0000000002A00000-0x0000000002A01000-memory.dmp

    Filesize

    4KB

  • memory/2960-45-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/2960-44-0x00000000029C0000-0x00000000029C1000-memory.dmp

    Filesize

    4KB

  • memory/2960-43-0x00000000029A0000-0x00000000029A1000-memory.dmp

    Filesize

    4KB

  • memory/2960-42-0x00000000027D0000-0x00000000027D1000-memory.dmp

    Filesize

    4KB

  • memory/2960-41-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2960-40-0x0000000002750000-0x0000000002751000-memory.dmp

    Filesize

    4KB

  • memory/2960-39-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2960-38-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/2960-37-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

    Filesize

    4KB

  • memory/2960-36-0x0000000002A90000-0x0000000002A91000-memory.dmp

    Filesize

    4KB

  • memory/2960-9-0x0000000002570000-0x0000000002571000-memory.dmp

    Filesize

    4KB

  • memory/2960-64-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-65-0x00000000003C0000-0x00000000003F0000-memory.dmp

    Filesize

    192KB

  • memory/2960-66-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-67-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-68-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-69-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-70-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-71-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-72-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-73-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-74-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-75-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB

  • memory/2960-76-0x0000000000400000-0x0000000000547000-memory.dmp

    Filesize

    1.3MB