Overview

overview

7

Static

static

5aa2a4b418...6a.exe

windows7-x64

7

5aa2a4b418...6a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    175s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2022, 19:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5aa2a4b41857e176fdf1721e7a45b28e7bed8754f9b3f10e7ac5ff8d234cf26a.exe

  • Size

    170KB

  • MD5

    fc3bdfec5907968cc35af7ed8eb49784

  • SHA1

    2e34767187c03733e07f7882a3490d9bfa1aebd3

  • SHA256

    5aa2a4b41857e176fdf1721e7a45b28e7bed8754f9b3f10e7ac5ff8d234cf26a

  • SHA512

    b7ab999b2d04366de12799a843d06d4971ace3826c6d5194db547cc15437c90ce01ca65a7b9997d7bcf96ec6264f35ef305604a87d3921aba933b9706f51c3af

  • SSDEEP

    3072:ReWfjw5CsqDbgXu6dbrePqNdLn+BvU5clFIW2ZZdYbi9mbF:h85Csq6breAEU5ciW2ZZNy

Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5aa2a4b41857e176fdf1721e7a45b28e7bed8754f9b3f10e7ac5ff8d234cf26a.exe
    "C:\Users\Admin\AppData\Local\Temp\5aa2a4b41857e176fdf1721e7a45b28e7bed8754f9b3f10e7ac5ff8d234cf26a.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1868

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1868-132-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/1868-133-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

    Download