Overview

overview

10

Static

static

a5f8319e23...49.exe

windows7_x64

1

a5f8319e23...49.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 18:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a5f8319e230bf2cbe2be5406e42072cbae69086979232912bc49feaea56d5c49.exe

  • Size

    1.6MB

  • MD5

    5b305ebf70fa30b9fa99dfb27ff07f60

  • SHA1

    54711aca678363e5af1674a158edb7fffc26a985

  • SHA256

    a5f8319e230bf2cbe2be5406e42072cbae69086979232912bc49feaea56d5c49

  • SHA512

    643ccb1d5ef37c4acb0cf658a457a0c2b9a0697dd744c1c94ece6ba6008c5487b831d55ad6f50c6801f42d8c358b7ef39ef51e0e32472e1144c92fedff5ffcce

Score
10/10
bootkitpersistencesuricata

Malware Config

Signatures

  • suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

    suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

    suricata
  • Downloads MZ/PE file
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Modifies registry class 11 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5f8319e230bf2cbe2be5406e42072cbae69086979232912bc49feaea56d5c49.exe
    "C:\Users\Admin\AppData\Local\Temp\a5f8319e230bf2cbe2be5406e42072cbae69086979232912bc49feaea56d5c49.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2716

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads