Analysis
-
max time kernel
46s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27/05/2023, 23:11
Static task
static1
1 signatures
windows7-x64
9 signatures
1800 seconds
General
-
Target
-
Size
14KB
-
MD5
19dbec50735b5f2a72d4199c4e184960
-
SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822
-
SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
-
SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
SSDEEP
192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 [email protected] -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 544 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 544 taskmgr.exe Token: SeShutdownPrivilege 1424 [email protected] Token: SeShutdownPrivilege 620 [email protected] -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe 544 taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 324 wrote to memory of 1996 324 [email protected] 26 PID 324 wrote to memory of 1996 324 [email protected] 26 PID 324 wrote to memory of 1996 324 [email protected] 26 PID 324 wrote to memory of 1996 324 [email protected] 26 PID 324 wrote to memory of 1424 324 [email protected] 27 PID 324 wrote to memory of 1424 324 [email protected] 27 PID 324 wrote to memory of 1424 324 [email protected] 27 PID 324 wrote to memory of 1424 324 [email protected] 27 PID 324 wrote to memory of 620 324 [email protected] 28 PID 324 wrote to memory of 620 324 [email protected] 28 PID 324 wrote to memory of 620 324 [email protected] 28 PID 324 wrote to memory of 620 324 [email protected] 28 PID 324 wrote to memory of 2032 324 [email protected] 29 PID 324 wrote to memory of 2032 324 [email protected] 29 PID 324 wrote to memory of 2032 324 [email protected] 29 PID 324 wrote to memory of 2032 324 [email protected] 29 PID 324 wrote to memory of 828 324 [email protected] 30 PID 324 wrote to memory of 828 324 [email protected] 30 PID 324 wrote to memory of 828 324 [email protected] 30 PID 324 wrote to memory of 828 324 [email protected] 30 PID 324 wrote to memory of 872 324 [email protected] 31 PID 324 wrote to memory of 872 324 [email protected] 31 PID 324 wrote to memory of 872 324 [email protected] 31 PID 324 wrote to memory of 872 324 [email protected] 31 PID 872 wrote to memory of 2044 872 [email protected] 32 PID 872 wrote to memory of 2044 872 [email protected] 32 PID 872 wrote to memory of 2044 872 [email protected] 32 PID 872 wrote to memory of 2044 872 [email protected] 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:324
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1996
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1424
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:620
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:828
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵PID:2044
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:544
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf