Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 00:15
Behavioral task
behavioral1
Sample
33098b79f4fbe47f6196bfe823d41fa3.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
33098b79f4fbe47f6196bfe823d41fa3.exe
Resource
win10v2004-20231215-en
7 signatures
150 seconds
General
-
Target
33098b79f4fbe47f6196bfe823d41fa3.exe
-
Size
12.3MB
-
MD5
33098b79f4fbe47f6196bfe823d41fa3
-
SHA1
4279c26e60b02fe4ac60485221052a049dc67da9
-
SHA256
84279d15180e853b3ce2d6bc7249c070aa190b9dd563d38c1732c56ede3820bb
-
SHA512
8c0bb8b8fa8765fbe4a11dbf6b0b26b80b07e0123978cbaced1431509db65a5e54b134e58b2bbb287481d057a1869db2e6d5ddb2d4feec23e23cdd0885d5b243
-
SSDEEP
196608:lB/U7um1KQHQpf9PFC5Uz+IEx0WMydcC4hKTp3JPm+FARbIi2sMf5B:zU7Vo2QD4ij00WMychwve+mRb51g
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2276-4-0x0000000000400000-0x0000000001B4B000-memory.dmp vmprotect behavioral1/memory/2276-9-0x0000000000400000-0x0000000001B4B000-memory.dmp vmprotect behavioral1/memory/2276-48-0x0000000000400000-0x0000000001B4B000-memory.dmp vmprotect -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 33098b79f4fbe47f6196bfe823d41fa3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2276 33098b79f4fbe47f6196bfe823d41fa3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2276 33098b79f4fbe47f6196bfe823d41fa3.exe 2276 33098b79f4fbe47f6196bfe823d41fa3.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2564 wmic.exe Token: SeSecurityPrivilege 2564 wmic.exe Token: SeTakeOwnershipPrivilege 2564 wmic.exe Token: SeLoadDriverPrivilege 2564 wmic.exe Token: SeSystemProfilePrivilege 2564 wmic.exe Token: SeSystemtimePrivilege 2564 wmic.exe Token: SeProfSingleProcessPrivilege 2564 wmic.exe Token: SeIncBasePriorityPrivilege 2564 wmic.exe Token: SeCreatePagefilePrivilege 2564 wmic.exe Token: SeBackupPrivilege 2564 wmic.exe Token: SeRestorePrivilege 2564 wmic.exe Token: SeShutdownPrivilege 2564 wmic.exe Token: SeDebugPrivilege 2564 wmic.exe Token: SeSystemEnvironmentPrivilege 2564 wmic.exe Token: SeRemoteShutdownPrivilege 2564 wmic.exe Token: SeUndockPrivilege 2564 wmic.exe Token: SeManageVolumePrivilege 2564 wmic.exe Token: 33 2564 wmic.exe Token: 34 2564 wmic.exe Token: 35 2564 wmic.exe Token: SeIncreaseQuotaPrivilege 2564 wmic.exe Token: SeSecurityPrivilege 2564 wmic.exe Token: SeTakeOwnershipPrivilege 2564 wmic.exe Token: SeLoadDriverPrivilege 2564 wmic.exe Token: SeSystemProfilePrivilege 2564 wmic.exe Token: SeSystemtimePrivilege 2564 wmic.exe Token: SeProfSingleProcessPrivilege 2564 wmic.exe Token: SeIncBasePriorityPrivilege 2564 wmic.exe Token: SeCreatePagefilePrivilege 2564 wmic.exe Token: SeBackupPrivilege 2564 wmic.exe Token: SeRestorePrivilege 2564 wmic.exe Token: SeShutdownPrivilege 2564 wmic.exe Token: SeDebugPrivilege 2564 wmic.exe Token: SeSystemEnvironmentPrivilege 2564 wmic.exe Token: SeRemoteShutdownPrivilege 2564 wmic.exe Token: SeUndockPrivilege 2564 wmic.exe Token: SeManageVolumePrivilege 2564 wmic.exe Token: 33 2564 wmic.exe Token: 34 2564 wmic.exe Token: 35 2564 wmic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2276 33098b79f4fbe47f6196bfe823d41fa3.exe 2276 33098b79f4fbe47f6196bfe823d41fa3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2564 2276 33098b79f4fbe47f6196bfe823d41fa3.exe 28 PID 2276 wrote to memory of 2564 2276 33098b79f4fbe47f6196bfe823d41fa3.exe 28 PID 2276 wrote to memory of 2564 2276 33098b79f4fbe47f6196bfe823d41fa3.exe 28 PID 2276 wrote to memory of 2564 2276 33098b79f4fbe47f6196bfe823d41fa3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\33098b79f4fbe47f6196bfe823d41fa3.exe"C:\Users\Admin\AppData\Local\Temp\33098b79f4fbe47f6196bfe823d41fa3.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564
-