Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
04/08/2023, 14:40
General
-
Target
ghost.exe
-
Size
4.8MB
-
MD5
c91ce8b8a160b5692ff07732339810cf
-
SHA1
d872586b5c88622a35441774b84d9010e49b18da
-
SHA256
997f6482b974df269158e93ea849275da24841c295998a11e7d21a0b73632b66
-
SHA512
084b0192ce6fe492164200900b7cc43230804612b206ef1d5a891aae58daef130873a9b3a496b23355a846f2be16c1bd6e21e3b5e596f132bc9309b9e2ce4a19
-
SSDEEP
98304:QfFdKQaIz9KGDTR79dBT5T+A1AVApXEQ0411L4n:Gb9DhRdBT5GV1KTLK
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ghost.exe"C:\Users\Admin\AppData\Local\Temp\ghost.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken