Overview

overview

6

Static

static

1

startup.exe

windows7-x64

6

startup.exe

windows10-2004-x64

6

Resubmissions

21/02/2024, 23:40

240221-3n972shc29 6

21/02/2024, 23:15

240221-28vgnaha26 6

Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/02/2024, 23:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    startup.exe

  • Size

    2.7MB

  • MD5

    0c3c4751da6a247b3229c8a94b40fc74

  • SHA1

    0e783415e91f632bc74240bee35463fcc049c283

  • SHA256

    d40d7b877916f9c27391436f740430a4ad8fccfe1300cb86b8518f790d33a6a9

  • SHA512

    24a0247c66624648ec47048846e5d79e09460f0053699d97c9b450c5168f9fc7d99738a2b916e905bbe5d07b62d71163d2a1bf50114603fe050c2087f66065e6

  • SSDEEP

    49152:UA4GxC0r4i4zQwmGmgetbQG5pXWVg9tq2Kqjgyi79nb3Ug5G2Pju1yg7JWdLn:ZFrR4zQ/gKbQ45870gzRdAlK

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 48 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\startup.exe
    "C:\Users\Admin\AppData\Local\Temp\startup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\AppData\Local\Temp\{47a081c0-d10f-11ee-bf06-56d57a935c49}\startup.exe
      "C:\Users\Admin\AppData\Local\Temp\{47a081c0-d10f-11ee-bf06-56d57a935c49}\startup.exe" /-nodrop /-"install=C:\Users\Admin\AppData\Local\Temp"
      2⤵
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1728

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\47AC1A81-D10F-11EE-BF06-56D57A935C49\WAIT_ROLLBACK_PAGE.html
          Filesize

          1KB

          MD5

          d6e7de3a758dd8a27afc365c06caa082

          SHA1

          b3b946e50226c88d4d19735e3ab95aafd9fe7a5d

          SHA256

          323db54e745bc87bc6e14fec6e5ab6cfb2f095f2fc2153a5c92895f13234d1ec

          SHA512

          f1d7a5ed5571d769621252d4e40cb071202b8ecda2e6206d299a732da4c0fb0a0515d62af8342d0b49a1c745857e081f455c3e941f24f63c4fcb1fbc64ec62b0

          Download Submit

        • \Users\Admin\AppData\Local\Temp\{47a081c0-d10f-11ee-bf06-56d57a935c49}\startup.exe
          Filesize

          2.7MB

          MD5

          0c3c4751da6a247b3229c8a94b40fc74

          SHA1

          0e783415e91f632bc74240bee35463fcc049c283

          SHA256

          d40d7b877916f9c27391436f740430a4ad8fccfe1300cb86b8518f790d33a6a9

          SHA512

          24a0247c66624648ec47048846e5d79e09460f0053699d97c9b450c5168f9fc7d99738a2b916e905bbe5d07b62d71163d2a1bf50114603fe050c2087f66065e6

          Download Submit

        • \Users\Admin\AppData\Local\Temp\{47ac1a80-d10f-11ee-bf06-56d57a935c49}\SETUP.DLL
          Filesize

          7.3MB

          MD5

          77b8c752e366381fb8f9ecb5da969d10

          SHA1

          52ad6ef1a9d1dc0d4eaaa8db7246f49846ecbab4

          SHA256

          80af3f4eea24dcd733165eabeb409fc8f2ec966cf172a59b1d672c0ff2e67481

          SHA512

          d5c06d47a64b2f1d1e6a584ee4183390fc75f5f1995baae17522a9db7764c6a66eec13e3be1814d7117552fcbda9ba43ec5bb12e3618588731c54d2d9938b1cd

          Download Submit