Analysis

  • max time kernel
    142s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    18-01-2024 05:49

General

  • Target

    64a1a24c98e26083b75c147fbfd2339b.exe

  • Size

    135KB

  • MD5

    64a1a24c98e26083b75c147fbfd2339b

  • SHA1

    cab1e1da64f720f4e1f236c0bc02b46da4fc568d

  • SHA256

    cd10142b4cd46f126a024c30cc8014ec789fe990a95bda339a6a5206b7440a7a

  • SHA512

    246fef059949a2b46ff3351924c17992045f1907d429f77086b168aa37b72ff9dd4200589eeb30b898476738b11e05815f31416d138fa3dc9363282eacd54e8d

  • SSDEEP

    3072:gnnv5QbYQbUZbbrZ6+m6NiL15+Eq7Kf3Wrar7arBYFoFwuuL9H4+B3aW:gv4YJQKN8Q2ZGStP9Yyd

Score
9/10

Malware Config

Signatures

  • Nirsoft 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies registry class 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64a1a24c98e26083b75c147fbfd2339b.exe
    "C:\Users\Admin\AppData\Local\Temp\64a1a24c98e26083b75c147fbfd2339b.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2084-0-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2084-1-0x0000000000280000-0x00000000002B0000-memory.dmp

    Filesize

    192KB

  • memory/2084-2-0x00000000001E0000-0x00000000001E2000-memory.dmp

    Filesize

    8KB

  • memory/2084-4-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2084-5-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2084-6-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2084-3-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/2084-7-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2084-9-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2084-8-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/2084-10-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2084-11-0x0000000000280000-0x00000000002B0000-memory.dmp

    Filesize

    192KB