Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27-02-2024 06:21

General

  • Target

    SecuriteInfo.com.BScope.Adware.Softcnapp.24133.13453.exe

  • Size

    4.1MB

  • MD5

    1455ecad502896614e005c5173df16eb

  • SHA1

    9f572dcdf2ab17296753c2f10af2ad03dd4adb4a

  • SHA256

    1f292f89857b79f9e7766f9978c4100ed0aed53349cecadfc0adb54ae35ac7f4

  • SHA512

    9edea27b5dbdee9b74ff17eb54d36300d3ef91f2c1a6d61ed0379aad48c5648bee9faf62eb137ee3ba19713e98288bba042426db0d22dcc3392d3c66ea7cbbef

  • SSDEEP

    98304:ww2CYJJBGb5A9dGpQkiSNEVA0qss9duoakQrBQ:7w0ASCcIm9duoMrB

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies registry class 11 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Adware.Softcnapp.24133.13453.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BScope.Adware.Softcnapp.24133.13453.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2876-29-0x0000000000180000-0x0000000000181000-memory.dmp

    Filesize

    4KB