Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system - submitted
29/10/2023, 08:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11.exe
Resource
win7-20231020-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
11.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 11.exe
- Size 904KB
- Sample231029-kgetfsgg85
- SHA256 a0762a63b9deea8f379d3fe5a2ce0139bb30be3e8bd004ed59defcfa69132105
- MD5 ec6101acbf2b50bb868589253bd850d4
- SHA1 5003bd943d48d2ed38f0f16d7bfe4526cf6b5a9f
- SHA512 1fe2aca315d654d8fd7d1e67547b7698a32777c749d2e379e3b5b48af2ea2803073c8e4444566b3b804732309b3eb18a7f258a38b86fb2da25d93b0fa66a142d
- SSDEEP 12288:4aSFnXytmoMWMk7/RdRwRoF/LmwbTpYOUGVNG1mlG1qu9S:4lnXySWP7/PR2o1p/rGc41H
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" 11.exe - Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininit.exe 11.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininit.exe\debugger = "@$&&**)*&^$#____8*`~@!Dghhsyyw^&%$$.exe" 11.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\physicaldrive0 11.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe 348 11.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 348 11.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 348 11.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 348 11.exe 348 11.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11.exe"C:\Users\Admin\AppData\Local\Temp\11.exe"1⤵
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:348