Analysis
-
max time kernel
21s -
max time network
75s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-07-2021 10:42
Static task
static1
Behavioral task
behavioral1
Sample
Windows Loader.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Windows Loader.exe
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
Windows Loader.exe
-
Size
3.8MB
-
MD5
323c0fd51071400b51eedb1be90a8188
-
SHA1
0efc35935957c25193bbe9a83ab6caa25a487ada
-
SHA256
2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
-
SHA512
4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Windows Loader.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Windows Loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Windows Loader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
Windows Loader.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Windows Loader.exe Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Windows Loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct Windows Loader.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Windows Loader.exepid process 672 Windows Loader.exe 672 Windows Loader.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Windows Loader.exedescription pid process Token: 33 672 Windows Loader.exe Token: SeIncBasePriorityPrivilege 672 Windows Loader.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Windows Loader.exepid process 672 Windows Loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows Loader.exe"C:\Users\Admin\AppData\Local\Temp\Windows Loader.exe"1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-114-0x0000000002650000-0x00000000027F3000-memory.dmpFilesize
1.6MB