Analysis
-
max time kernel
150s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
20/08/2023, 01:49
General
-
Target
8afc905c264a7e00b89e1f29d2e30d44.exe
-
Size
17.1MB
-
MD5
8afc905c264a7e00b89e1f29d2e30d44
-
SHA1
70b57a174fd6210c3a5241f20af43cf079e2e245
-
SHA256
ea087c479b0f47c8ec7026eb3ff2b6d1cf939f63715b3a7519ddc403bf6b513b
-
SHA512
279b399fa98691f560621abf975d8846e948fd780ea5e1ac53bc5e5faa13b193d24f0ed08775c5c58ea89a8c0ddb4658b768e9921ce96269b4ba893c696075a1
-
SSDEEP
393216:0V0Q4oIqRsl/c38/EV7w7GQTExdsjbqfnkgzObnzRb6:QSEq/q8cGK6EPNnlzOb0
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
VMProtect packed file 11 IoCs
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8afc905c264a7e00b89e1f29d2e30d44.exe"C:\Users\Admin\AppData\Local\Temp\8afc905c264a7e00b89e1f29d2e30d44.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_8afc905c264a7e00b89e1f29d2e30d44.exe"C:\Users\Admin\AppData\Local\Temp\._cache_8afc905c264a7e00b89e1f29d2e30d44.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.1MB
MD58afc905c264a7e00b89e1f29d2e30d44
SHA170b57a174fd6210c3a5241f20af43cf079e2e245
SHA256ea087c479b0f47c8ec7026eb3ff2b6d1cf939f63715b3a7519ddc403bf6b513b
SHA512279b399fa98691f560621abf975d8846e948fd780ea5e1ac53bc5e5faa13b193d24f0ed08775c5c58ea89a8c0ddb4658b768e9921ce96269b4ba893c696075a1
-
Filesize
17.1MB
MD58afc905c264a7e00b89e1f29d2e30d44
SHA170b57a174fd6210c3a5241f20af43cf079e2e245
SHA256ea087c479b0f47c8ec7026eb3ff2b6d1cf939f63715b3a7519ddc403bf6b513b
SHA512279b399fa98691f560621abf975d8846e948fd780ea5e1ac53bc5e5faa13b193d24f0ed08775c5c58ea89a8c0ddb4658b768e9921ce96269b4ba893c696075a1
-
Filesize
17.1MB
MD58afc905c264a7e00b89e1f29d2e30d44
SHA170b57a174fd6210c3a5241f20af43cf079e2e245
SHA256ea087c479b0f47c8ec7026eb3ff2b6d1cf939f63715b3a7519ddc403bf6b513b
SHA512279b399fa98691f560621abf975d8846e948fd780ea5e1ac53bc5e5faa13b193d24f0ed08775c5c58ea89a8c0ddb4658b768e9921ce96269b4ba893c696075a1
-
Filesize
16.3MB
MD50ea6a399a2e431b805a03c4b5f2d338c
SHA1558eb8d58f1b287dff7dff4177f7ee128539dbb8
SHA256dce7ed370cbb4c6010d317d7fd99209f66a27f026673316beac0326e4fd4c10f
SHA51274112698d910527d4b8a71cb7baea515c919689f7303e27e7aeb42c89800132749b83c99d548c289c6d5af97cccee52415cf5b8d6e9beaa23009c562a8f5b7fe
-
Filesize
16.3MB
MD50ea6a399a2e431b805a03c4b5f2d338c
SHA1558eb8d58f1b287dff7dff4177f7ee128539dbb8
SHA256dce7ed370cbb4c6010d317d7fd99209f66a27f026673316beac0326e4fd4c10f
SHA51274112698d910527d4b8a71cb7baea515c919689f7303e27e7aeb42c89800132749b83c99d548c289c6d5af97cccee52415cf5b8d6e9beaa23009c562a8f5b7fe
-
Filesize
16.3MB
MD50ea6a399a2e431b805a03c4b5f2d338c
SHA1558eb8d58f1b287dff7dff4177f7ee128539dbb8
SHA256dce7ed370cbb4c6010d317d7fd99209f66a27f026673316beac0326e4fd4c10f
SHA51274112698d910527d4b8a71cb7baea515c919689f7303e27e7aeb42c89800132749b83c99d548c289c6d5af97cccee52415cf5b8d6e9beaa23009c562a8f5b7fe
-
Filesize
16.3MB
MD50ea6a399a2e431b805a03c4b5f2d338c
SHA1558eb8d58f1b287dff7dff4177f7ee128539dbb8
SHA256dce7ed370cbb4c6010d317d7fd99209f66a27f026673316beac0326e4fd4c10f
SHA51274112698d910527d4b8a71cb7baea515c919689f7303e27e7aeb42c89800132749b83c99d548c289c6d5af97cccee52415cf5b8d6e9beaa23009c562a8f5b7fe
-
Filesize
16.3MB
MD50ea6a399a2e431b805a03c4b5f2d338c
SHA1558eb8d58f1b287dff7dff4177f7ee128539dbb8
SHA256dce7ed370cbb4c6010d317d7fd99209f66a27f026673316beac0326e4fd4c10f
SHA51274112698d910527d4b8a71cb7baea515c919689f7303e27e7aeb42c89800132749b83c99d548c289c6d5af97cccee52415cf5b8d6e9beaa23009c562a8f5b7fe
-
Filesize
1KB
MD5f4f53a0f1a2d01d6452199517276991f
SHA17308bb8206a4cb18bc924c084e126417a8c6d3a8
SHA2563024ab0d24acd49ad05672c906ba1944d96a8237b3f1e9b8aa15a50fb74c2776
SHA512255588a478d95a27325f158970f9f9407c51c6306a047e28fb76a01307427c4477c8506733095c0dd85de944721bff632801d06139e5defebddda3681ce19fb0
-
Filesize
17.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
33.7MB
-
Filesize
33.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
33.7MB
-
Filesize
4KB
-
Filesize
33.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
33.7MB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
33.7MB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
17.1MB
-
Filesize
4KB
-
Filesize
17.1MB