Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2024, 21:06

General

  • Target

    5969721d2dc4657b7c2c3673bd069999.exe

  • Size

    352KB

  • MD5

    5969721d2dc4657b7c2c3673bd069999

  • SHA1

    e151c30e64e15333e4681887ddf882900d3b10a2

  • SHA256

    612dd0ec18f33d07ceafbd2feff2b38cc296a0faf5be5967b74448fcf6222ad9

  • SHA512

    ad2b406485cf01c3017b1d10070cfdfb07c033ed09739c0445342bed657bf42f6ff5366f66896f0996e3a46f7227cb035c5fc3659abe68df4b7526e5c8c02357

  • SSDEEP

    6144:ExgEVdGJoM4PYJ6fQy++AIw8Zqqbq4n+aCyIK3ccnMxjOFUd:OgSWorYJqQMzfGIW1K3Dns3d

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies registry class 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5969721d2dc4657b7c2c3673bd069999.exe
    "C:\Users\Admin\AppData\Local\Temp\5969721d2dc4657b7c2c3673bd069999.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1992-1-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/1992-0-0x0000000000400000-0x0000000000634000-memory.dmp

    Filesize

    2.2MB

  • memory/1992-5-0x0000000000350000-0x0000000000351000-memory.dmp

    Filesize

    4KB

  • memory/1992-4-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/1992-3-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/1992-2-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB

  • memory/1992-6-0x0000000000400000-0x0000000000634000-memory.dmp

    Filesize

    2.2MB

  • memory/1992-9-0x0000000000360000-0x0000000000361000-memory.dmp

    Filesize

    4KB