Analysis
-
max time kernel
45s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 01:54
Static task
static1
Behavioral task
behavioral1
Sample
238308308dd2fb3a121a4c4138f574c9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
238308308dd2fb3a121a4c4138f574c9.exe
Resource
win10v2004-20231215-en
General
-
Target
238308308dd2fb3a121a4c4138f574c9.exe
-
Size
148KB
-
MD5
238308308dd2fb3a121a4c4138f574c9
-
SHA1
33725e29215793b12f2b42b8fffa8c95c0749bdf
-
SHA256
a9382245fc7f801bbc9e8ce3ea77bef071231f774309ea0ccc1afe6705d790f0
-
SHA512
1fd612a7c0e0abf8fee3919edd87a6e35dcb567bb308dceb210ad87a8512cb208eb2ff858ebcdb6b94d6d92f3eccf99834e3750688caefd38041248ac5eb3d28
-
SSDEEP
3072:NlOKLY64bK+6jgKt3GVNBoUYndqXWgRF6tXE4RNd2FGyEmpfOU4dy:/Y64bK/ATkqGgRv8NcFjpWpd
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
238308308dd2fb3a121a4c4138f574c9.exedescription ioc process File opened for modification \??\physicaldrive0 238308308dd2fb3a121a4c4138f574c9.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
238308308dd2fb3a121a4c4138f574c9.exepid process 2404 238308308dd2fb3a121a4c4138f574c9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
238308308dd2fb3a121a4c4138f574c9.exedescription pid process Token: SeShutdownPrivilege 2404 238308308dd2fb3a121a4c4138f574c9.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2404-0-0x0000000000430000-0x0000000000452000-memory.dmpFilesize
136KB
-
memory/2404-1-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/2404-2-0x0000000000430000-0x0000000000452000-memory.dmpFilesize
136KB
-
memory/2404-3-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB