Analysis
-
max time kernel
15s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
13/10/2023, 20:48
Errors
Reason
Machine shutdown
General
-
Target
2023-08-25_de8bc935a263ee8567b6169b67ba3874_xiaoba_JC.exe
-
Size
700KB
-
MD5
de8bc935a263ee8567b6169b67ba3874
-
SHA1
9f138671b9cc434926dfef1c6a20ee335648b6b8
-
SHA256
bd4634c411ba8bb4a42379c7d5c16784ba6c292982f7ef5fe0a87c76a2dbcc70
-
SHA512
cab46fbf52b22d1c32a854a55e2c71fee1c8eb5e5627530395a0962f576b9025160c4a67deab30f3427d8f1bcb82dc87579f76a4f36d813e539a5c0dc47b99b3
-
SSDEEP
12288:rSqIYTIQfKpkPvH70o3osXW8QB2qdyfzUEEDd9QygxDms:SQgwposm8QfWwEEDYygx
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-25_de8bc935a263ee8567b6169b67ba3874_xiaoba_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-25_de8bc935a263ee8567b6169b67ba3874_xiaoba_JC.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
4KB