Analysis
-
max time kernel
971s -
max time network
1225s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2023, 08:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NoWayHomeDebug.exe
Resource
win7-20230621-en
windows7-x64
12 signatures
1800 seconds
Behavioral task
behavioral2
Sample
NoWayHomeDebug.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
2 signatures
1800 seconds
General
-
Target
NoWayHomeDebug.exe
-
Size
54KB
-
MD5
1a0ec7b1ccb1adb0a4ef099b3a34ce4f
-
SHA1
2a849d090471f56ce14ab9f16efc7ee9c44912b1
-
SHA256
8e1421d288a33b697525ee93b9dff6d9933a5218e2b82cefc6fb333abd09360a
-
SHA512
f4447cff6c20374e9a13c018899fbb06acc1346f321329f713380eb4e20689e99ad9819064b913287e0a5538c62799051bb8620e2258962d1e57e69c5959c667
-
SSDEEP
1536:RKUqE8vGT9kAOtJ20NmTxFw/2fxLrsJFk:RdR8v6kAOO0Nm1mF
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 NoWayHomeDebug.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe Token: SeTakeOwnershipPrivilege 5052 NoWayHomeDebug.exe