Analysis
-
max time kernel
121s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
07-11-2023 16:04
General
-
Target
58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe
-
Size
1.9MB
-
MD5
20ec40cf51b72055a91e2233f901b82c
-
SHA1
d995f6af37a28ce912c2cdec74c8419fb22f9962
-
SHA256
58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664
-
SHA512
212afde272dd61b9f0ed78e18c818dbdd6c8bf8b8f149f342f69e20eaeb84a7c007b0819cfca51d83a250496d1883e86a0aee6516fd43c14445f4f94321cbad9
-
SSDEEP
49152:ozXeC3Q1XEEAQ55PAyNpmm4GUb66bjtzcqJ/JyGbzQ6:YtQ10EP55PAyl4bb6cthRyGY6
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: RenamesItself 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe"C:\Users\Admin\AppData\Local\Temp\58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe"C:\Users\Admin\AppData\Local\Temp\58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe" 22642⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-590322.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-590322.dll Bugreport %E9%AA%A8%E5%A4%B4QQ%E9%99%8C%E7%94%9F%E7%A9%BA%E9%97%B4%E7%95%99%E7%97%95%E8%B5%9E%203⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5f41246250bf75b16de32a896efa1675e
SHA1c8e27c4dc3bc709dbd341fa93ea1a08cea34e88a
SHA256fa121aabc7462d20f6dcdda4823333ba5bbde9bf967c415353b2c91c8cf537fd
SHA512008e6f15ebecc027005c5639d5b7e40d8a5d95929508ae161694c0f2ab543106f36f3604422d5d0b04c1619907ca07937781694106349545e2daba6ce74595d3
-
Filesize
1.9MB
MD5f41246250bf75b16de32a896efa1675e
SHA1c8e27c4dc3bc709dbd341fa93ea1a08cea34e88a
SHA256fa121aabc7462d20f6dcdda4823333ba5bbde9bf967c415353b2c91c8cf537fd
SHA512008e6f15ebecc027005c5639d5b7e40d8a5d95929508ae161694c0f2ab543106f36f3604422d5d0b04c1619907ca07937781694106349545e2daba6ce74595d3
-
Filesize
1.9MB
MD5f41246250bf75b16de32a896efa1675e
SHA1c8e27c4dc3bc709dbd341fa93ea1a08cea34e88a
SHA256fa121aabc7462d20f6dcdda4823333ba5bbde9bf967c415353b2c91c8cf537fd
SHA512008e6f15ebecc027005c5639d5b7e40d8a5d95929508ae161694c0f2ab543106f36f3604422d5d0b04c1619907ca07937781694106349545e2daba6ce74595d3
-
Filesize
168KB
MD543be7626394c21d1fd281ec41ff21617
SHA1b25237e8523a77ab5d972c027854d6f1411bbb62
SHA256b201e8c170a6b1dbd4c6d4da04c18e956070e6b2c46d647a63a094252cea6984
SHA5128d08fc8cb8d351be32330886376a2a91e53d064b0e880396c93e104fcf1e15f8f64295f77e849f39d27a69717eec5106dfd1aebdc499af16b65567e3e61cd19e
-
Filesize
168KB
MD543be7626394c21d1fd281ec41ff21617
SHA1b25237e8523a77ab5d972c027854d6f1411bbb62
SHA256b201e8c170a6b1dbd4c6d4da04c18e956070e6b2c46d647a63a094252cea6984
SHA5128d08fc8cb8d351be32330886376a2a91e53d064b0e880396c93e104fcf1e15f8f64295f77e849f39d27a69717eec5106dfd1aebdc499af16b65567e3e61cd19e
-
Filesize
113B
MD5f3bd78ac84568ae7290b806399a1cada
SHA19b269e5c32d9985a73a4d270337cedb8e1ff480b
SHA256091892ff0788a1169cd6d5810d13a41248bb4059c4cec77c59e4d64660579e3c
SHA51251f6546073285c8453debaa9f9f2631d9ab845abcc34a04a3dbf1de462a351ecd828b8e44f1fcaadbf071d86921bfec7a192cd355fd504c7f4ffbc690dc2c15d
-
Filesize
133B
MD5d76ff64be1c3bfa1466c4ce4f85279bf
SHA10636ec586cbabc9ed8dd539d24bfb47b1d04a489
SHA256c861a7a4ef5b0095cd476928e74f63d1a9ed7caadc7431d70aa8d8bc0b132f99
SHA51201a162d0137bff087945673006d0e9a41251cade77cc0a522d76ac1a2570b1761cd16625e50c0420a84a9da2c0b596fb7cb0ce29047df1b349b9b0be32a3eaf1
-
Filesize
548B
MD5dbbbff50292825eae4e994e639ab267c
SHA138ac3c177675572d7cf91c4b083b46b2265b34c2
SHA256339331e02bf441039b3b8773559bfe7f6b6e9784b37c36ac7669d7c2a09a4105
SHA5124028beb9fd2a0fc284a6123f5484c1e18dbf0e36e623bc9627f7ff3cb977a0ab8898573e9c1590437c147596b2fd772543bc0af3c0172fdb8cad049d6a90f9e9
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
1.9MB
MD5f41246250bf75b16de32a896efa1675e
SHA1c8e27c4dc3bc709dbd341fa93ea1a08cea34e88a
SHA256fa121aabc7462d20f6dcdda4823333ba5bbde9bf967c415353b2c91c8cf537fd
SHA512008e6f15ebecc027005c5639d5b7e40d8a5d95929508ae161694c0f2ab543106f36f3604422d5d0b04c1619907ca07937781694106349545e2daba6ce74595d3
-
Filesize
168KB
MD543be7626394c21d1fd281ec41ff21617
SHA1b25237e8523a77ab5d972c027854d6f1411bbb62
SHA256b201e8c170a6b1dbd4c6d4da04c18e956070e6b2c46d647a63a094252cea6984
SHA5128d08fc8cb8d351be32330886376a2a91e53d064b0e880396c93e104fcf1e15f8f64295f77e849f39d27a69717eec5106dfd1aebdc499af16b65567e3e61cd19e
-
Filesize
168KB
MD543be7626394c21d1fd281ec41ff21617
SHA1b25237e8523a77ab5d972c027854d6f1411bbb62
SHA256b201e8c170a6b1dbd4c6d4da04c18e956070e6b2c46d647a63a094252cea6984
SHA5128d08fc8cb8d351be32330886376a2a91e53d064b0e880396c93e104fcf1e15f8f64295f77e849f39d27a69717eec5106dfd1aebdc499af16b65567e3e61cd19e
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
456KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
228KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
228KB
-
Filesize
228KB