Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2024 04:19

General

  • Target

    3be001b680218c4c3322f63b918f0d53.exe

  • Size

    395KB

  • MD5

    3be001b680218c4c3322f63b918f0d53

  • SHA1

    bdc4cd6e22d864abd02c1fa7109c1bc83ccfa5f6

  • SHA256

    7d07ca94eaf1bc96c1d7a5d0d7f17cecc2225bb33c7058afd21d7a354d451d74

  • SHA512

    02670fe370958e99a5cbca504528ecb58136c8192e938784c8851a01d02e98c6092dd70ab21d44d3aac584bfcd5f82f30b53abb697204793f31d26f70373a8cb

  • SSDEEP

    12288:YT+CBfh2vArpTnt2aNdtfQunka1KNaTnH:Y/hEArZt2afFBkkzH

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3be001b680218c4c3322f63b918f0d53.exe
    "C:\Users\Admin\AppData\Local\Temp\3be001b680218c4c3322f63b918f0d53.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2288-0-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/2288-1-0x0000000000330000-0x0000000000374000-memory.dmp

    Filesize

    272KB

  • memory/2288-2-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/2288-3-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2288-4-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2288-5-0x0000000000380000-0x0000000000381000-memory.dmp

    Filesize

    4KB

  • memory/2288-6-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2288-7-0x00000000004E0000-0x00000000004E2000-memory.dmp

    Filesize

    8KB

  • memory/2288-8-0x00000000004D0000-0x00000000004D1000-memory.dmp

    Filesize

    4KB

  • memory/2288-9-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

  • memory/2288-10-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2288-11-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2288-12-0x0000000000500000-0x0000000000501000-memory.dmp

    Filesize

    4KB

  • memory/2288-13-0x0000000001F90000-0x0000000001F91000-memory.dmp

    Filesize

    4KB

  • memory/2288-14-0x0000000000570000-0x0000000000571000-memory.dmp

    Filesize

    4KB

  • memory/2288-16-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

    Filesize

    4KB

  • memory/2288-15-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

    Filesize

    4KB

  • memory/2288-17-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

    Filesize

    4KB

  • memory/2288-18-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

    Filesize

    4KB

  • memory/2288-19-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

    Filesize

    4KB

  • memory/2288-20-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

    Filesize

    4KB

  • memory/2288-21-0x0000000002010000-0x0000000002011000-memory.dmp

    Filesize

    4KB

  • memory/2288-22-0x0000000002000000-0x0000000002001000-memory.dmp

    Filesize

    4KB

  • memory/2288-23-0x0000000002020000-0x0000000002021000-memory.dmp

    Filesize

    4KB

  • memory/2288-24-0x0000000002050000-0x0000000002051000-memory.dmp

    Filesize

    4KB

  • memory/2288-26-0x0000000002070000-0x0000000002071000-memory.dmp

    Filesize

    4KB

  • memory/2288-25-0x0000000002040000-0x0000000002041000-memory.dmp

    Filesize

    4KB

  • memory/2288-27-0x0000000002060000-0x0000000002061000-memory.dmp

    Filesize

    4KB

  • memory/2288-28-0x0000000002090000-0x0000000002091000-memory.dmp

    Filesize

    4KB

  • memory/2288-29-0x0000000002080000-0x0000000002081000-memory.dmp

    Filesize

    4KB

  • memory/2288-30-0x00000000020B0000-0x00000000020B1000-memory.dmp

    Filesize

    4KB

  • memory/2288-31-0x00000000020A0000-0x00000000020A1000-memory.dmp

    Filesize

    4KB

  • memory/2288-32-0x00000000020D0000-0x00000000020D1000-memory.dmp

    Filesize

    4KB

  • memory/2288-33-0x00000000020C0000-0x00000000020C1000-memory.dmp

    Filesize

    4KB

  • memory/2288-44-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/2288-43-0x0000000002570000-0x0000000002571000-memory.dmp

    Filesize

    4KB

  • memory/2288-42-0x0000000002580000-0x0000000002581000-memory.dmp

    Filesize

    4KB

  • memory/2288-41-0x0000000002550000-0x0000000002551000-memory.dmp

    Filesize

    4KB

  • memory/2288-40-0x0000000002560000-0x0000000002561000-memory.dmp

    Filesize

    4KB

  • memory/2288-39-0x0000000002530000-0x0000000002531000-memory.dmp

    Filesize

    4KB

  • memory/2288-38-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/2288-37-0x0000000002510000-0x0000000002511000-memory.dmp

    Filesize

    4KB

  • memory/2288-36-0x0000000002520000-0x0000000002521000-memory.dmp

    Filesize

    4KB

  • memory/2288-35-0x00000000020E0000-0x00000000020E1000-memory.dmp

    Filesize

    4KB

  • memory/2288-34-0x00000000020F0000-0x00000000020F1000-memory.dmp

    Filesize

    4KB

  • memory/2288-46-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/2288-48-0x00000000025F0000-0x00000000025F1000-memory.dmp

    Filesize

    4KB

  • memory/2288-49-0x0000000003040000-0x0000000003041000-memory.dmp

    Filesize

    4KB

  • memory/2288-47-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/2288-51-0x0000000002030000-0x0000000002031000-memory.dmp

    Filesize

    4KB

  • memory/2288-52-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB

  • memory/2288-50-0x0000000003170000-0x0000000003171000-memory.dmp

    Filesize

    4KB

  • memory/2288-45-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/2288-53-0x0000000002600000-0x0000000002601000-memory.dmp

    Filesize

    4KB

  • memory/2288-55-0x0000000003180000-0x0000000003181000-memory.dmp

    Filesize

    4KB

  • memory/2288-54-0x0000000003060000-0x0000000003061000-memory.dmp

    Filesize

    4KB

  • memory/2288-56-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

  • memory/2288-57-0x0000000000330000-0x0000000000374000-memory.dmp

    Filesize

    272KB