Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 10:58
Behavioral task
behavioral1
Sample
86ca4cff34bf8d2cc8be3c59cfabc1d2.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
86ca4cff34bf8d2cc8be3c59cfabc1d2.exe
Resource
win10v2004-20231215-en
7 signatures
150 seconds
General
-
Target
86ca4cff34bf8d2cc8be3c59cfabc1d2.exe
-
Size
12.3MB
-
MD5
86ca4cff34bf8d2cc8be3c59cfabc1d2
-
SHA1
cd74a0faa905012ba407aaea0298b6ff4075c0ad
-
SHA256
a1d6030e01106ead25c6cb67a8ed080ae66d198d0a7d225776349d3938c263f8
-
SHA512
5e5823ae5e699a11faef061e666fa42e6a7ba5e2e0b9e7d97743d092d6fd37ffbeef1d6f016a89d4b82696c3cdd26e7e8f77ad4b97dfc94dd73cdfa53d056177
-
SSDEEP
196608:fuaCVjcHlRncPDcizHp8zmVZfJ+L2dKI4NkqoGrhcpICwo/ik6WX4Jgf7UBHKHC4:fuaS6mDBpKmbkLAKB4/irWoJeUBqi4
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/928-1-0x0000000000400000-0x0000000001B44000-memory.dmp vmprotect behavioral2/memory/928-8-0x0000000000400000-0x0000000001B44000-memory.dmp vmprotect behavioral2/memory/928-15-0x0000000000400000-0x0000000001B44000-memory.dmp vmprotect -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1352 wmic.exe Token: SeSecurityPrivilege 1352 wmic.exe Token: SeTakeOwnershipPrivilege 1352 wmic.exe Token: SeLoadDriverPrivilege 1352 wmic.exe Token: SeSystemProfilePrivilege 1352 wmic.exe Token: SeSystemtimePrivilege 1352 wmic.exe Token: SeProfSingleProcessPrivilege 1352 wmic.exe Token: SeIncBasePriorityPrivilege 1352 wmic.exe Token: SeCreatePagefilePrivilege 1352 wmic.exe Token: SeBackupPrivilege 1352 wmic.exe Token: SeRestorePrivilege 1352 wmic.exe Token: SeShutdownPrivilege 1352 wmic.exe Token: SeDebugPrivilege 1352 wmic.exe Token: SeSystemEnvironmentPrivilege 1352 wmic.exe Token: SeRemoteShutdownPrivilege 1352 wmic.exe Token: SeUndockPrivilege 1352 wmic.exe Token: SeManageVolumePrivilege 1352 wmic.exe Token: 33 1352 wmic.exe Token: 34 1352 wmic.exe Token: 35 1352 wmic.exe Token: 36 1352 wmic.exe Token: SeIncreaseQuotaPrivilege 1352 wmic.exe Token: SeSecurityPrivilege 1352 wmic.exe Token: SeTakeOwnershipPrivilege 1352 wmic.exe Token: SeLoadDriverPrivilege 1352 wmic.exe Token: SeSystemProfilePrivilege 1352 wmic.exe Token: SeSystemtimePrivilege 1352 wmic.exe Token: SeProfSingleProcessPrivilege 1352 wmic.exe Token: SeIncBasePriorityPrivilege 1352 wmic.exe Token: SeCreatePagefilePrivilege 1352 wmic.exe Token: SeBackupPrivilege 1352 wmic.exe Token: SeRestorePrivilege 1352 wmic.exe Token: SeShutdownPrivilege 1352 wmic.exe Token: SeDebugPrivilege 1352 wmic.exe Token: SeSystemEnvironmentPrivilege 1352 wmic.exe Token: SeRemoteShutdownPrivilege 1352 wmic.exe Token: SeUndockPrivilege 1352 wmic.exe Token: SeManageVolumePrivilege 1352 wmic.exe Token: 33 1352 wmic.exe Token: 34 1352 wmic.exe Token: 35 1352 wmic.exe Token: 36 1352 wmic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 928 wrote to memory of 1352 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe 94 PID 928 wrote to memory of 1352 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe 94 PID 928 wrote to memory of 1352 928 86ca4cff34bf8d2cc8be3c59cfabc1d2.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\86ca4cff34bf8d2cc8be3c59cfabc1d2.exe"C:\Users\Admin\AppData\Local\Temp\86ca4cff34bf8d2cc8be3c59cfabc1d2.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352
-