Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
21-10-2023 13:42
General
-
Target
b3b9ac0cbe3a60dbd0fc681a581f84f48198cbf906ad1e2cbdf191d383dd7cab.exe
-
Size
1.5MB
-
MD5
cf1b4ade9920efce9fd4b65e7691b950
-
SHA1
d3507edfad910574313483b34d04c2dc64bcfe21
-
SHA256
b3b9ac0cbe3a60dbd0fc681a581f84f48198cbf906ad1e2cbdf191d383dd7cab
-
SHA512
6b4ab0f802add296f47732ff1fdb7d9427c42af32a23589dc032826c0451434edbfb469853be5b56e9527675590217f931372d2eeb55909bc9ab0f2f85e2b6c9
-
SSDEEP
24576:5i6/JL130obUM5gD60tIXh7YgNZBOMXWovKqV5esYQlrMPTt7KCxWLDM9MQ21y9H:gu0oZx5eNWMrJK439Ml1y9cG1f
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3b9ac0cbe3a60dbd0fc681a581f84f48198cbf906ad1e2cbdf191d383dd7cab.exe"C:\Users\Admin\AppData\Local\Temp\b3b9ac0cbe3a60dbd0fc681a581f84f48198cbf906ad1e2cbdf191d383dd7cab.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
860KB
-
Filesize
2.0MB
-
Filesize
860KB