Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
29/10/2023, 04:51
General
-
Target
Roentgenium.exe
-
Size
242KB
-
MD5
2beb2b6e43c116c7dcee6422c2f9336a
-
SHA1
00a9e9692a5fb702f9af849ad54e2c2c2cbc2922
-
SHA256
4bb94cf51bee6e55a2adf0107562d5e8076fc863f3e6610355aed39e040ce466
-
SHA512
0f493b69c9da32fc3d2f3dd36fa7b533b277f1418dc5b47ab1d48fe238a16cd15e8d8f9bb9086439c660bc2ec9a2dd5cf6fae625992344976c854c2c7eabb661
-
SSDEEP
1536:Iev1XT3NWs5LFtyQJDE34ESFBp/BL8gZYJ5BsKs6KwS27VlGdDXiSL:D1zx5L7c4ES7pBQjJ5BE6fSElGJtL
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roentgenium.exe"C:\Users\Admin\AppData\Local\Temp\Roentgenium.exe"1⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f0 0x3001⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
268KB