f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802.exe
Size

9.0MB
MD5

6cf2b01f601ff646b26a396f06ac57a5
SHA1

0f68a3354f8cf67c5f8a302cfae94b680648d1b7
SHA256

f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802
SHA512

e4a450e111c1e416fc302d1598683f7f319daaf0860cc42696acf5cf39bd93c1059e03e00efe3c9e92f184e780d06f4a0044e025c527e4a279a09b5f1f7ea061
SSDEEP

196608:VBa5gJhtsZ7fCuCJzaHoJBVtMIZLwXoeK12:V0Gc5CF8ofVnZMXoey

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2104	f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802.exe
2104	f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802.exe
2104	f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802.exe

C:\Users\Admin\AppData\Local\Temp\f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802.exe
"C:\Users\Admin\AppData\Local\Temp\f3195a8565710a7f3a7009ccd707b2ceb729c09e10976e0d13b208e153ec6802.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\iRidium pro documents\Server\Logs\y2024_m11_d21_h09_m23_s05(0).txt

Filesize
585B

MD5
4939971d214f74dd1c6dbb7c985de4e5

SHA1
5d7c6d35468b481c8b14a38995962eb967845c03

SHA256
97a4d85a78a14cd78fe4fe41ce5decabbd0880dc7e17f1610947aa49ffc4199b

SHA512
5fd14ff18094f6b9a048376f3917390678c53480303b94331d7d1fa1c127a2dc4db8d26a18fbd53ce33ea21f73c38f4c9efecb60b762db395bcbc774ce282aa5

Download Submit