Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 11:55
Behavioral task
behavioral1
Sample
353731ae9dda7ff1b817ebd3dcf19be0.exe
Resource
win7-20231129-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
353731ae9dda7ff1b817ebd3dcf19be0.exe
Resource
win10v2004-20231215-en
7 signatures
150 seconds
General
-
Target
353731ae9dda7ff1b817ebd3dcf19be0.exe
-
Size
12.3MB
-
MD5
353731ae9dda7ff1b817ebd3dcf19be0
-
SHA1
858553c037dabb406ffa63057e893ac3605d5cc7
-
SHA256
4534a3f8a8e037b838f888ef435840eb425d861984fc7e3ca0c4397a25181a3e
-
SHA512
abe4dedaa11ed997c225b0f825253ac289245028b9952cc05602529b40554d308c3f750b10c3971e24f1b49b3b411cc95cef7d4ff57eeb93dffcb016e1226e92
-
SSDEEP
196608:z1yN/m3XsFuQFDjT3jmu44gb39b5w0IbA17WDr2ZIF5q9bmJCoRtIx5E:hm/gXsFuQtaHb39brIbA17Ncq9bmJlIY
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3036-0-0x0000000000400000-0x0000000001B56000-memory.dmp vmprotect behavioral1/memory/3036-41-0x0000000000400000-0x0000000001B56000-memory.dmp vmprotect behavioral1/memory/3036-47-0x0000000000400000-0x0000000001B56000-memory.dmp vmprotect -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 353731ae9dda7ff1b817ebd3dcf19be0.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3036 353731ae9dda7ff1b817ebd3dcf19be0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3036 353731ae9dda7ff1b817ebd3dcf19be0.exe 3036 353731ae9dda7ff1b817ebd3dcf19be0.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2644 wmic.exe Token: SeSecurityPrivilege 2644 wmic.exe Token: SeTakeOwnershipPrivilege 2644 wmic.exe Token: SeLoadDriverPrivilege 2644 wmic.exe Token: SeSystemProfilePrivilege 2644 wmic.exe Token: SeSystemtimePrivilege 2644 wmic.exe Token: SeProfSingleProcessPrivilege 2644 wmic.exe Token: SeIncBasePriorityPrivilege 2644 wmic.exe Token: SeCreatePagefilePrivilege 2644 wmic.exe Token: SeBackupPrivilege 2644 wmic.exe Token: SeRestorePrivilege 2644 wmic.exe Token: SeShutdownPrivilege 2644 wmic.exe Token: SeDebugPrivilege 2644 wmic.exe Token: SeSystemEnvironmentPrivilege 2644 wmic.exe Token: SeRemoteShutdownPrivilege 2644 wmic.exe Token: SeUndockPrivilege 2644 wmic.exe Token: SeManageVolumePrivilege 2644 wmic.exe Token: 33 2644 wmic.exe Token: 34 2644 wmic.exe Token: 35 2644 wmic.exe Token: SeIncreaseQuotaPrivilege 2644 wmic.exe Token: SeSecurityPrivilege 2644 wmic.exe Token: SeTakeOwnershipPrivilege 2644 wmic.exe Token: SeLoadDriverPrivilege 2644 wmic.exe Token: SeSystemProfilePrivilege 2644 wmic.exe Token: SeSystemtimePrivilege 2644 wmic.exe Token: SeProfSingleProcessPrivilege 2644 wmic.exe Token: SeIncBasePriorityPrivilege 2644 wmic.exe Token: SeCreatePagefilePrivilege 2644 wmic.exe Token: SeBackupPrivilege 2644 wmic.exe Token: SeRestorePrivilege 2644 wmic.exe Token: SeShutdownPrivilege 2644 wmic.exe Token: SeDebugPrivilege 2644 wmic.exe Token: SeSystemEnvironmentPrivilege 2644 wmic.exe Token: SeRemoteShutdownPrivilege 2644 wmic.exe Token: SeUndockPrivilege 2644 wmic.exe Token: SeManageVolumePrivilege 2644 wmic.exe Token: 33 2644 wmic.exe Token: 34 2644 wmic.exe Token: 35 2644 wmic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3036 353731ae9dda7ff1b817ebd3dcf19be0.exe 3036 353731ae9dda7ff1b817ebd3dcf19be0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2644 3036 353731ae9dda7ff1b817ebd3dcf19be0.exe 29 PID 3036 wrote to memory of 2644 3036 353731ae9dda7ff1b817ebd3dcf19be0.exe 29 PID 3036 wrote to memory of 2644 3036 353731ae9dda7ff1b817ebd3dcf19be0.exe 29 PID 3036 wrote to memory of 2644 3036 353731ae9dda7ff1b817ebd3dcf19be0.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\353731ae9dda7ff1b817ebd3dcf19be0.exe"C:\Users\Admin\AppData\Local\Temp\353731ae9dda7ff1b817ebd3dcf19be0.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644
-