Analysis

  • max time kernel
    3s
  • max time network
    3s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    02/03/2024, 16:47

Errors

Reason
Machine shutdown

General

  • Target

  • Size

    136KB

  • MD5

    70108103a53123201ceb2e921fcfe83c

  • SHA1

    c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

  • SHA256

    9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

  • SHA512

    996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

  • SSDEEP

    1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\sys3.exe
      C:\Users\Admin\AppData\Local\Temp\\sys3.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of AdjustPrivilegeToken
      PID:2828
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2988
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2484

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\systm.txt

              Filesize

              59B

              MD5

              ab7368e081dc109f4133ffd943c98b74

              SHA1

              1847691b3535b25f368389327543392eafd3e4fa

              SHA256

              6c2c3417ded140721c60368f64f02b4d4ed5f39b528450b75d2475da4b80c1ae

              SHA512

              e59e763b66ab716a72d3121d8a8b9b6a2dd4beb89e949202ae55ef0a1cef316d56071df8a41a587c605d1575c18f2f4f3a41d2cb174a89558722e9730a913912

            • \Users\Admin\AppData\Local\Temp\sys3.exe

              Filesize

              136KB

              MD5

              70108103a53123201ceb2e921fcfe83c

              SHA1

              c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

              SHA256

              9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

              SHA512

              996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

            • memory/2484-13-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

              Filesize

              4KB

            • memory/2764-0-0x000000002AA00000-0x000000002AA24000-memory.dmp

              Filesize

              144KB

            • memory/2828-11-0x000000002AA00000-0x000000002AA24000-memory.dmp

              Filesize

              144KB

            • memory/2988-12-0x0000000002E10000-0x0000000002E11000-memory.dmp

              Filesize

              4KB