Analysis
- max time kernel
3s - max time network
3s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
- submitted
02/03/2024, 16:47
Errors
Reason
Machine shutdown
General
- Target [email protected]
- Size 136KB
- Sample240302-valzasfe46
- SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeC:\Users\Admin\AppData\Local\Temp\\sys3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
systm.txt
sys3.exe
memory/2484-13-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
memory/2764-0-0x000000002AA00000-0x000000002AA24000-memory.dmp
memory/2828-11-0x000000002AA00000-0x000000002AA24000-memory.dmp
memory/2988-12-0x0000000002E10000-0x0000000002E11000-memory.dmp