Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
08-10-2023 08:11
General
-
Target
9559290ceaf58ad39285e9e3ecae21aec3307bf5e25cc067fd7051fab1e73200.exe
-
Size
7.2MB
-
MD5
cff414bb8d947a1300da3f8ebe9996d3
-
SHA1
32ac439861caadb6700a91167b059ff92a97b32c
-
SHA256
9559290ceaf58ad39285e9e3ecae21aec3307bf5e25cc067fd7051fab1e73200
-
SHA512
5e74fd94db0ef6a0b777bf573e95e57056ee732b3d39e8facbf74534e5aa09757d974dce6aa9d618d85020faed364ebfdaba90f89eb46abd17929338092d3569
-
SSDEEP
196608:e06qWWwGytIXXLH/35We8kD+t9+ouKmI:eYWW7ytMXDx3A4oiI
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9559290ceaf58ad39285e9e3ecae21aec3307bf5e25cc067fd7051fab1e73200.exe"C:\Users\Admin\AppData\Local\Temp\9559290ceaf58ad39285e9e3ecae21aec3307bf5e25cc067fd7051fab1e73200.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 37322⤵
- Program crash
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.4MB
MD58b6c94bbdbfb213e94a5dcb4fac28ce3
SHA1b56102ca4f03556f387f8b30e2b404efabe0cb65
SHA256982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
SHA5129d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
16.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB