Analysis
- max time kernel
151s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
14/10/2023, 02:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe
- Size 1.4MB
- Sample231014-c6bt4acc61
- SHA256 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0
- MD5 94eb172192db34708f96960d27b16ae5
- SHA1 c8ddfbbde642992ece5322f18155ff3cda8b3970
- SHA512 46d93e681d61cfd3aca143deb194c5230337687b943147b8da667db441c7011418ec437aecdd4ff8c1856b2619f7ba57170af8c8f7b3d8aa22027d06818e225e
- SSDEEP 12288:aCKeGGfG6udZpIcJPQLGCQaOHbOceDg6frUgVBy9:aCKeGG8dZ/QiuOCcQg6DUgVE9
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe - Checks for any installed AV software in registry 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Launcher bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe 4340 bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe"C:\Users\Admin\AppData\Local\Temp\bf7782fe90a4ac160b74d33652b1d708f0e41de2c53782d3bb1e265dd5c44de0.exe"1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\uTxFoBqKuWyTgTeT\360ini.dll
- Size 4.3MB
- SHA256 a5c4a7521cb743b6d8fe4adf45797e3f99fa61cf65fdf4f3d1147988b8c5fb1f
- MD5 fd33b0dfbc35f3da4b7425b9b196d1cb
- SHA1 aa4f1fe0f9ebff8c2b4349228666226d98bce68b
- SHA512 722c16b2541611cb0cb48c7447452c32441a3d5403f39d809ad500be6c7e0cf47820822fd2386878a1f44487a6909457943192013d72f474995e155320a74abe
- SSDEEP 98304:Ghr99PAw23isuiPyeDYqHWuYtk0OQAPqDPbbfH0r++XWhVF26YAheiL:8r9v2iHiPyONmk0tAPqQzXWvF2YeA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\uTxFoBqKuWyTgTeT\360ini.dll
- Size 4.3MB
- SHA256 a5c4a7521cb743b6d8fe4adf45797e3f99fa61cf65fdf4f3d1147988b8c5fb1f
- MD5 fd33b0dfbc35f3da4b7425b9b196d1cb
- SHA1 aa4f1fe0f9ebff8c2b4349228666226d98bce68b
- SHA512 722c16b2541611cb0cb48c7447452c32441a3d5403f39d809ad500be6c7e0cf47820822fd2386878a1f44487a6909457943192013d72f474995e155320a74abe
- SSDEEP 98304:Ghr99PAw23isuiPyeDYqHWuYtk0OQAPqDPbbfH0r++XWhVF26YAheiL:8r9v2iHiPyONmk0tAPqQzXWvF2YeA
- MD5 SHA1 SHA512 SSDEEP