Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
20/08/2023, 01:01
General
-
Target
0fe588f524664a352fd9c2f5efc2e66b.exe
-
Size
9.4MB
-
MD5
0fe588f524664a352fd9c2f5efc2e66b
-
SHA1
b92b15995dae030110e62f576075073e4a6436b3
-
SHA256
4943d53a38ac123ed7c04ad44742a67ea06bb54ea02fa241d9c4ebadab4cb99a
-
SHA512
75cdf6e1cdcbe3d2baa79b0e957ad837c7de0b00d954c2c15713aae624f24d94c981804ee6f79888276b11b891841a61272624daffa392db454f88b303836def
-
SSDEEP
98304:m78+6nAoMji8TlWPUJlCSIz6xRROC9zDv5uHeumm4hw63i:wKAoSD5xRN5uHevS
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fe588f524664a352fd9c2f5efc2e66b.exe"C:\Users\Admin\AppData\Local\Temp\0fe588f524664a352fd9c2f5efc2e66b.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD55a5b92b34ae2f82f90ea5ce1964df9bf
SHA132a0ff07dfd31931ec90b74dd7a4594d640645ed
SHA2565d11d947fc1f9b5af5b6f5c8c10c9e68ee2001dfda8b0bf950163d145b664672
SHA51238b199074e5d403a001a77614335205ff0809a921302bdba3358e089d52a77666f6657507321b5581efca827ded32f5af35bd0165f528a7d1e412f20ebc10f8d
-
Filesize
185KB
MD537c11d2ef302de16c4b9de8827950e2d
SHA110c7038d5e8cfe72e78f1d2b8c88b9f83fd5ca12
SHA2568d0edd3d4718567bea1cc47c5efd9e738ecffe9e75b62ada9a6f43a82e0dc1fd
SHA5122c77573fc1553fa796247cc20603ee7aa8c35192b97927f07c89c477f501ab0af2a7766ace6a8c2cea8240d309a53b56ae6f4ec10d7d32cc494ad0c1145fbb57
-
Filesize
392KB
-
Filesize
5.9MB