Analysis
-
max time kernel
141s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 00:15
Behavioral task
behavioral1
Sample
33098b79f4fbe47f6196bfe823d41fa3.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
33098b79f4fbe47f6196bfe823d41fa3.exe
Resource
win10v2004-20231215-en
7 signatures
150 seconds
General
-
Target
33098b79f4fbe47f6196bfe823d41fa3.exe
-
Size
12.3MB
-
MD5
33098b79f4fbe47f6196bfe823d41fa3
-
SHA1
4279c26e60b02fe4ac60485221052a049dc67da9
-
SHA256
84279d15180e853b3ce2d6bc7249c070aa190b9dd563d38c1732c56ede3820bb
-
SHA512
8c0bb8b8fa8765fbe4a11dbf6b0b26b80b07e0123978cbaced1431509db65a5e54b134e58b2bbb287481d057a1869db2e6d5ddb2d4feec23e23cdd0885d5b243
-
SSDEEP
196608:lB/U7um1KQHQpf9PFC5Uz+IEx0WMydcC4hKTp3JPm+FARbIi2sMf5B:zU7Vo2QD4ij00WMychwve+mRb51g
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1356-3-0x0000000000400000-0x0000000001B4B000-memory.dmp vmprotect behavioral2/memory/1356-8-0x0000000000400000-0x0000000001B4B000-memory.dmp vmprotect behavioral2/memory/1356-15-0x0000000000400000-0x0000000001B4B000-memory.dmp vmprotect -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 33098b79f4fbe47f6196bfe823d41fa3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1356 33098b79f4fbe47f6196bfe823d41fa3.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1356 33098b79f4fbe47f6196bfe823d41fa3.exe 1356 33098b79f4fbe47f6196bfe823d41fa3.exe 1356 33098b79f4fbe47f6196bfe823d41fa3.exe 1356 33098b79f4fbe47f6196bfe823d41fa3.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1584 wmic.exe Token: SeSecurityPrivilege 1584 wmic.exe Token: SeTakeOwnershipPrivilege 1584 wmic.exe Token: SeLoadDriverPrivilege 1584 wmic.exe Token: SeSystemProfilePrivilege 1584 wmic.exe Token: SeSystemtimePrivilege 1584 wmic.exe Token: SeProfSingleProcessPrivilege 1584 wmic.exe Token: SeIncBasePriorityPrivilege 1584 wmic.exe Token: SeCreatePagefilePrivilege 1584 wmic.exe Token: SeBackupPrivilege 1584 wmic.exe Token: SeRestorePrivilege 1584 wmic.exe Token: SeShutdownPrivilege 1584 wmic.exe Token: SeDebugPrivilege 1584 wmic.exe Token: SeSystemEnvironmentPrivilege 1584 wmic.exe Token: SeRemoteShutdownPrivilege 1584 wmic.exe Token: SeUndockPrivilege 1584 wmic.exe Token: SeManageVolumePrivilege 1584 wmic.exe Token: 33 1584 wmic.exe Token: 34 1584 wmic.exe Token: 35 1584 wmic.exe Token: 36 1584 wmic.exe Token: SeIncreaseQuotaPrivilege 1584 wmic.exe Token: SeSecurityPrivilege 1584 wmic.exe Token: SeTakeOwnershipPrivilege 1584 wmic.exe Token: SeLoadDriverPrivilege 1584 wmic.exe Token: SeSystemProfilePrivilege 1584 wmic.exe Token: SeSystemtimePrivilege 1584 wmic.exe Token: SeProfSingleProcessPrivilege 1584 wmic.exe Token: SeIncBasePriorityPrivilege 1584 wmic.exe Token: SeCreatePagefilePrivilege 1584 wmic.exe Token: SeBackupPrivilege 1584 wmic.exe Token: SeRestorePrivilege 1584 wmic.exe Token: SeShutdownPrivilege 1584 wmic.exe Token: SeDebugPrivilege 1584 wmic.exe Token: SeSystemEnvironmentPrivilege 1584 wmic.exe Token: SeRemoteShutdownPrivilege 1584 wmic.exe Token: SeUndockPrivilege 1584 wmic.exe Token: SeManageVolumePrivilege 1584 wmic.exe Token: 33 1584 wmic.exe Token: 34 1584 wmic.exe Token: 35 1584 wmic.exe Token: 36 1584 wmic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1356 33098b79f4fbe47f6196bfe823d41fa3.exe 1356 33098b79f4fbe47f6196bfe823d41fa3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1356 wrote to memory of 1584 1356 33098b79f4fbe47f6196bfe823d41fa3.exe 92 PID 1356 wrote to memory of 1584 1356 33098b79f4fbe47f6196bfe823d41fa3.exe 92 PID 1356 wrote to memory of 1584 1356 33098b79f4fbe47f6196bfe823d41fa3.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\33098b79f4fbe47f6196bfe823d41fa3.exe"C:\Users\Admin\AppData\Local\Temp\33098b79f4fbe47f6196bfe823d41fa3.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584
-