Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-12-2024 17:46
General
-
Target
foo/04884a82d01d733f245d921e1f74fb1b.exe
-
Size
2.9MB
-
MD5
04884a82d01d733f245d921e1f74fb1b
-
SHA1
975c743feccce12419d4d72f26c2d44c8591118a
-
SHA256
e3d13acdbf704b60569fad130fec670ff20d99183fb4bfb32f339dd3138a5f2f
-
SHA512
c7f26c9656a14a2865da01e7903f29b2474e5fb3bb7a054d09fdd7ea476f7c3666bf4b3fc87e676c4829c0f51942273bb8161b448e42246898985874389a072c
-
SSDEEP
49152:Iv/bcmHcai2ga/yK3MSrNkd+YDSIT9Q3n4Ej5BHYDXTYPQnRxlP2RvTA7V0RZOr5:ccCcai2gaB3MN+YD44UHYDjYkh0vTA5X
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\foo\04884a82d01d733f245d921e1f74fb1b.exe"C:\Users\Admin\AppData\Local\Temp\foo\04884a82d01d733f245d921e1f74fb1b.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks processor information in registry