Analysis
-
max time kernel
90s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2023 16:58
Static task
static1
Behavioral task
behavioral1
Sample
AxInterop.WMPLib.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral2
Sample
Interop.WMPLib.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
MrBeast.exe
Resource
win10v2004-20221111-en
General
-
Target
MrBeast.exe
-
Size
3.6MB
-
MD5
1dadda882b9fb38f4f6568968d90ebff
-
SHA1
6ff605d69494c75bb5d34a364956bbe5eb63defc
-
SHA256
ea041dabf8f9790ce767ad47e383507db97d26fc27e5fd6a578f6232587aa91f
-
SHA512
461c864cfa40f56d37ffc8a11e518698d10c654b18d543f36d4fde80b317b1b809d3ad9cf5ff99334c8210ca98ed07ad2278228c7f242241d157eac8a9a7c9c3
-
SSDEEP
98304:Rwowao+WTd1a/mP4NYGcjzwowao+WTd1a/mP4NY:RHwQ0XZJGcvHwQ0XZJ
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: MrBeast.exe File opened (read-only) \??\M: MrBeast.exe File opened (read-only) \??\N: MrBeast.exe File opened (read-only) \??\P: MrBeast.exe File opened (read-only) \??\U: MrBeast.exe File opened (read-only) \??\V: MrBeast.exe File opened (read-only) \??\J: MrBeast.exe File opened (read-only) \??\S: MrBeast.exe File opened (read-only) \??\T: MrBeast.exe File opened (read-only) \??\X: MrBeast.exe File opened (read-only) \??\Z: MrBeast.exe File opened (read-only) \??\G: MrBeast.exe File opened (read-only) \??\I: MrBeast.exe File opened (read-only) \??\O: MrBeast.exe File opened (read-only) \??\Q: MrBeast.exe File opened (read-only) \??\R: MrBeast.exe File opened (read-only) \??\H: MrBeast.exe File opened (read-only) \??\B: MrBeast.exe File opened (read-only) \??\E: MrBeast.exe File opened (read-only) \??\F: MrBeast.exe File opened (read-only) \??\L: MrBeast.exe File opened (read-only) \??\W: MrBeast.exe File opened (read-only) \??\Y: MrBeast.exe File opened (read-only) \??\A: MrBeast.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2076 MrBeast.exe Token: SeCreatePagefilePrivilege 2076 MrBeast.exe