Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
26-08-2023 09:29
General
-
Target
8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721.exe
-
Size
5.1MB
-
MD5
abd60ea9357ed25a18723aa9edf77171
-
SHA1
dab5fd418b793eacd8efa0baf005bd10f026a7b9
-
SHA256
8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721
-
SHA512
485f7243ed9701c593d6df5d14e6b135d87a26d20e83243c63fc219078f32d8f2bde9bd55ca88e85c70ce09ff29f70ed04977b1a1a02b7d4c85d861ddbe37a44
-
SSDEEP
98304:ANFWSfLtP8wZXk6AiSef1LLb7Q2ucRvFKwVvelYNVQkeFM0oTkJ6U2S2:IFNVRkOh1Lk2ldKQ2lsVQvG
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
-
UPX packed file 50 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of FindShellTrayWindow 13 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721.exe"C:\Users\Admin\AppData\Local\Temp\8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\ÂÌÉ«¹«Òæ(΢¶Ë)\8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721.exe"F:\ÂÌÉ«¹«Òæ(΢¶Ë)\8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\ÂÌÉ«¹«Òæ(΢¶Ë)\ÂÌÉ«¹«Òæ(¹ý°×).exe"F:\ÂÌÉ«¹«Òæ(΢¶Ë)\ÂÌÉ«¹«Òæ(¹ý°×).exe"3⤵
- Executes dropped EXE
-
-
F:\ÂÌÉ«¹«Òæ(΢¶Ë)\8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721.exeF:\ÂÌÉ«¹«Òæ(΢¶Ë)\8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\ÂÌÉ«¹«Òæ(΢¶Ë)\ÂÌÉ«¹«Òæ(¹ý°×).exe"F:\ÂÌÉ«¹«Òæ(΢¶Ë)\ÂÌÉ«¹«Òæ(¹ý°×).exe"4⤵
- Executes dropped EXE
-
-
F:\ÂÌÉ«¹«Òæ(΢¶Ë)\8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721.exeF:\ÂÌÉ«¹«Òæ(΢¶Ë)\8b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
F:\ÂÌÉ«¹«Òæ(΢¶Ë)\ÂÌÉ«¹«Òæ(¹ý°×).exe"F:\ÂÌÉ«¹«Òæ(΢¶Ë)\ÂÌÉ«¹«Òæ(¹ý°×).exe"5⤵
- Executes dropped EXE
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD5abd60ea9357ed25a18723aa9edf77171
SHA1dab5fd418b793eacd8efa0baf005bd10f026a7b9
SHA2568b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721
SHA512485f7243ed9701c593d6df5d14e6b135d87a26d20e83243c63fc219078f32d8f2bde9bd55ca88e85c70ce09ff29f70ed04977b1a1a02b7d4c85d861ddbe37a44
-
Filesize
5.1MB
MD5abd60ea9357ed25a18723aa9edf77171
SHA1dab5fd418b793eacd8efa0baf005bd10f026a7b9
SHA2568b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721
SHA512485f7243ed9701c593d6df5d14e6b135d87a26d20e83243c63fc219078f32d8f2bde9bd55ca88e85c70ce09ff29f70ed04977b1a1a02b7d4c85d861ddbe37a44
-
Filesize
5.1MB
MD5abd60ea9357ed25a18723aa9edf77171
SHA1dab5fd418b793eacd8efa0baf005bd10f026a7b9
SHA2568b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721
SHA512485f7243ed9701c593d6df5d14e6b135d87a26d20e83243c63fc219078f32d8f2bde9bd55ca88e85c70ce09ff29f70ed04977b1a1a02b7d4c85d861ddbe37a44
-
Filesize
5.1MB
MD5abd60ea9357ed25a18723aa9edf77171
SHA1dab5fd418b793eacd8efa0baf005bd10f026a7b9
SHA2568b8f7c7e733b807c7c90c48be3b7e74a0cca8cac834997c931609ae31a9c7721
SHA512485f7243ed9701c593d6df5d14e6b135d87a26d20e83243c63fc219078f32d8f2bde9bd55ca88e85c70ce09ff29f70ed04977b1a1a02b7d4c85d861ddbe37a44
-
Filesize
59B
MD51bef43b38e175d067de109961b9bce23
SHA10d7457037f66d3a8442db17c133c160e90dd1ce0
SHA2567af9168959b1f2d43a8c6875f26972bfaa2c0b0ba2a671b64eb1340d8eae71de
SHA512edfc406903af839c62dfbef0e6091695c0c6762d3c5cbda4f1c8b396921437c9f8f2b5c9918939026ef430d565986703fd8a587c8f63b7d85dbe07a7ae511750
-
Filesize
59B
MD51bef43b38e175d067de109961b9bce23
SHA10d7457037f66d3a8442db17c133c160e90dd1ce0
SHA2567af9168959b1f2d43a8c6875f26972bfaa2c0b0ba2a671b64eb1340d8eae71de
SHA512edfc406903af839c62dfbef0e6091695c0c6762d3c5cbda4f1c8b396921437c9f8f2b5c9918939026ef430d565986703fd8a587c8f63b7d85dbe07a7ae511750
-
Filesize
59B
MD5bfaa3ba61c6a8e02b0d7499938cd6ad8
SHA1ed1a513f356e9ec535d6dd828605cbbd207229cb
SHA25633687864d97c577792e6193d0d8e0c2b7857328a3216e47dec0e3c57abfafb9f
SHA5124c1cb2127d45262fd151abf63b583896881a61c31e5d3a7a27a0a7b174787c8a63ccefee06aa9c34ce69978c080a530d5e0b2b33020a8a8faba7c87dfc967347
-
Filesize
5.3MB
MD5076579896c948e1c2d6828c985a13aac
SHA1f61da398669160ef6dbfbe71fb0bf01c262e541a
SHA25607d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd
SHA512737279195a8feb9aef460bd86688ea0a7bc0be3c900ceed132107ee878bf0503723a50ea85c6e2d003c903027c920bad5e82c78d1c16d925b75231f788a45d8d
-
Filesize
5.3MB
MD5076579896c948e1c2d6828c985a13aac
SHA1f61da398669160ef6dbfbe71fb0bf01c262e541a
SHA25607d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd
SHA512737279195a8feb9aef460bd86688ea0a7bc0be3c900ceed132107ee878bf0503723a50ea85c6e2d003c903027c920bad5e82c78d1c16d925b75231f788a45d8d
-
Filesize
5.3MB
MD5076579896c948e1c2d6828c985a13aac
SHA1f61da398669160ef6dbfbe71fb0bf01c262e541a
SHA25607d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd
SHA512737279195a8feb9aef460bd86688ea0a7bc0be3c900ceed132107ee878bf0503723a50ea85c6e2d003c903027c920bad5e82c78d1c16d925b75231f788a45d8d
-
Filesize
5.3MB
MD5076579896c948e1c2d6828c985a13aac
SHA1f61da398669160ef6dbfbe71fb0bf01c262e541a
SHA25607d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd
SHA512737279195a8feb9aef460bd86688ea0a7bc0be3c900ceed132107ee878bf0503723a50ea85c6e2d003c903027c920bad5e82c78d1c16d925b75231f788a45d8d
-
Filesize
5.3MB
MD5076579896c948e1c2d6828c985a13aac
SHA1f61da398669160ef6dbfbe71fb0bf01c262e541a
SHA25607d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd
SHA512737279195a8feb9aef460bd86688ea0a7bc0be3c900ceed132107ee878bf0503723a50ea85c6e2d003c903027c920bad5e82c78d1c16d925b75231f788a45d8d
-
Filesize
5.3MB
MD5076579896c948e1c2d6828c985a13aac
SHA1f61da398669160ef6dbfbe71fb0bf01c262e541a
SHA25607d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd
SHA512737279195a8feb9aef460bd86688ea0a7bc0be3c900ceed132107ee878bf0503723a50ea85c6e2d003c903027c920bad5e82c78d1c16d925b75231f788a45d8d
-
Filesize
5.3MB
MD5076579896c948e1c2d6828c985a13aac
SHA1f61da398669160ef6dbfbe71fb0bf01c262e541a
SHA25607d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd
SHA512737279195a8feb9aef460bd86688ea0a7bc0be3c900ceed132107ee878bf0503723a50ea85c6e2d003c903027c920bad5e82c78d1c16d925b75231f788a45d8d
-
Filesize
12.6MB
-
Filesize
732KB
-
Filesize
12.6MB
-
Filesize
732KB
-
Filesize
4KB
-
Filesize
12.6MB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
12.9MB
-
Filesize
12.9MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
12.9MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
32KB
-
Filesize
28KB
-
Filesize
32KB
-
Filesize
12.9MB
-
Filesize
12.9MB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
12.6MB
-
Filesize
732KB
-
Filesize
12.6MB
-
Filesize
732KB
-
Filesize
12.6MB
-
Filesize
4KB
-
Filesize
12.6MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
12.9MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
12.9MB
-
Filesize
12.9MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
12.9MB
-
Filesize
28KB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
32KB
-
Filesize
12.9MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
12.9MB