Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 09:07

General

  • Target

    a364d7ebe393eff2a6a7d5d6b0d01b51.exe

  • Size

    345KB

  • MD5

    a364d7ebe393eff2a6a7d5d6b0d01b51

  • SHA1

    0f21f416da5b9c88cb839977aba9eb076a9e4999

  • SHA256

    1600d3678c0ed899ac5419b5b7a03a8d5c543be39f685bc37ec9995f3a3be427

  • SHA512

    509c496a141fd6e7de027943335d1faced425ebe8769d842e040086e28394f7f7e06d175ad93cc8bfc7cfde863ad037cb294f3a7e8dece8e52369e8c0bf346a5

  • SSDEEP

    6144:nXW+Ehu2RwEUPiLLM8oWepq7n+aC1meyUGimMx0bmMQ46ChglcWwHixIx:XGHdoiLM8oWe4W1meyUGpOHM16CstwHT

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a364d7ebe393eff2a6a7d5d6b0d01b51.exe
    "C:\Users\Admin\AppData\Local\Temp\a364d7ebe393eff2a6a7d5d6b0d01b51.exe"
    1⤵
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2932

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2932-0-0x0000000000400000-0x0000000000503000-memory.dmp

          Filesize

          1.0MB

        • memory/2932-1-0x0000000002BF0000-0x0000000002C05000-memory.dmp

          Filesize

          84KB

        • memory/2932-4-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/2932-3-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/2932-5-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/2932-6-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/2932-7-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/2932-8-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/2932-10-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/2932-15-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/2932-18-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/2932-16-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/2932-13-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/2932-14-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/2932-12-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/2932-20-0x0000000002B20000-0x0000000002B30000-memory.dmp

          Filesize

          64KB

        • memory/2932-19-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/2932-11-0x0000000002C50000-0x0000000002C51000-memory.dmp

          Filesize

          4KB

        • memory/2932-9-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/2932-21-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

          Filesize

          4KB

        • memory/2932-32-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

          Filesize

          4KB

        • memory/2932-31-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

          Filesize

          4KB

        • memory/2932-33-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

          Filesize

          4KB

        • memory/2932-29-0x0000000002C70000-0x0000000002C71000-memory.dmp

          Filesize

          4KB

        • memory/2932-34-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

          Filesize

          4KB

        • memory/2932-30-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

          Filesize

          4KB

        • memory/2932-35-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

          Filesize

          4KB

        • memory/2932-28-0x0000000002D90000-0x0000000002D91000-memory.dmp

          Filesize

          4KB

        • memory/2932-27-0x0000000002C60000-0x0000000002C61000-memory.dmp

          Filesize

          4KB

        • memory/2932-26-0x0000000002B50000-0x0000000002B51000-memory.dmp

          Filesize

          4KB

        • memory/2932-25-0x0000000002B90000-0x0000000002B91000-memory.dmp

          Filesize

          4KB

        • memory/2932-24-0x0000000002C20000-0x0000000002C21000-memory.dmp

          Filesize

          4KB

        • memory/2932-23-0x00000000023C0000-0x00000000023C1000-memory.dmp

          Filesize

          4KB

        • memory/2932-22-0x0000000002260000-0x0000000002261000-memory.dmp

          Filesize

          4KB

        • memory/2932-36-0x0000000002F30000-0x0000000002F31000-memory.dmp

          Filesize

          4KB

        • memory/2932-37-0x0000000002E10000-0x0000000002E11000-memory.dmp

          Filesize

          4KB

        • memory/2932-39-0x0000000002F40000-0x0000000002F41000-memory.dmp

          Filesize

          4KB

        • memory/2932-38-0x0000000002F50000-0x0000000002F51000-memory.dmp

          Filesize

          4KB

        • memory/2932-40-0x0000000002F70000-0x0000000002F71000-memory.dmp

          Filesize

          4KB

        • memory/2932-41-0x0000000002F60000-0x0000000002F61000-memory.dmp

          Filesize

          4KB

        • memory/2932-43-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

          Filesize

          4KB

        • memory/2932-42-0x0000000002F80000-0x0000000002F81000-memory.dmp

          Filesize

          4KB

        • memory/2932-44-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

          Filesize

          4KB

        • memory/2932-45-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

          Filesize

          4KB

        • memory/2932-46-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

          Filesize

          4KB

        • memory/2932-54-0x0000000003040000-0x0000000003041000-memory.dmp

          Filesize

          4KB

        • memory/2932-53-0x0000000003050000-0x0000000003051000-memory.dmp

          Filesize

          4KB

        • memory/2932-52-0x0000000003020000-0x0000000003021000-memory.dmp

          Filesize

          4KB

        • memory/2932-55-0x0000000003070000-0x0000000003071000-memory.dmp

          Filesize

          4KB

        • memory/2932-56-0x0000000003060000-0x0000000003061000-memory.dmp

          Filesize

          4KB

        • memory/2932-50-0x0000000003000000-0x0000000003001000-memory.dmp

          Filesize

          4KB

        • memory/2932-51-0x0000000003030000-0x0000000003031000-memory.dmp

          Filesize

          4KB

        • memory/2932-49-0x0000000003010000-0x0000000003011000-memory.dmp

          Filesize

          4KB

        • memory/2932-47-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

          Filesize

          4KB

        • memory/2932-48-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

          Filesize

          4KB

        • memory/2932-57-0x0000000003080000-0x0000000003081000-memory.dmp

          Filesize

          4KB

        • memory/2932-58-0x00000000030B0000-0x00000000030B1000-memory.dmp

          Filesize

          4KB

        • memory/2932-59-0x00000000030A0000-0x00000000030A1000-memory.dmp

          Filesize

          4KB

        • memory/2932-60-0x00000000030D0000-0x00000000030D1000-memory.dmp

          Filesize

          4KB

        • memory/2932-61-0x00000000030C0000-0x00000000030C1000-memory.dmp

          Filesize

          4KB

        • memory/2932-62-0x00000000030F0000-0x00000000030F1000-memory.dmp

          Filesize

          4KB

        • memory/2932-63-0x00000000030E0000-0x00000000030E1000-memory.dmp

          Filesize

          4KB

        • memory/2932-64-0x0000000003110000-0x0000000003111000-memory.dmp

          Filesize

          4KB

        • memory/2932-65-0x0000000003100000-0x0000000003101000-memory.dmp

          Filesize

          4KB

        • memory/2932-357-0x0000000000400000-0x0000000000503000-memory.dmp

          Filesize

          1.0MB