Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
03-03-2024 13:51
General
-
Target
Trojan.Win32.KillDisk.exe
-
Size
60KB
-
MD5
571de903333a6951b8875a73f6cf99c5
-
SHA1
5c2ef418a36799541cec673dd7d9f87371a9e3bd
-
SHA256
8a81a1d0fae933862b51f63064069aa5af3854763f5edc29c997964de5e284e5
-
SHA512
dcfb8ae96ec975938592f22932a804b3105bc3293a22ed336bd9687045bc0e168e6aef9a1485f1a2d986e1d7e928221d7ee7b53f756958b700fc4dada503f309
-
SSDEEP
1536:8f0XnibgFacx2jecu0FRf6Ut3JhH0Y4LZ2FkRg:fEecVNvhUYqS
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Windows directory 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 33 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.KillDisk.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.KillDisk.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SaveUse.emf"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -nohome1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4032 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushSave.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD55ad5cd88c4799a17ff08a104906b55f6
SHA1082501fb01a58f587c2f799070c298ea1ee93bcb
SHA2566a5fa3811fbaa4a72d0bb714d3b10d4a7ce5f449deb25fe39d839affc7bebc8b
SHA512b5bc662b34c762c18c9b310ade671c0882c16cd2fe336d752449e85b982ed7c7ff36ed6c84aa7c8d1d9f5374f6ccc220b1ae9aae238476e6a57556b835a628a9
-
Filesize
992KB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
96KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
2.0MB
-
Filesize
16.7MB
-
Filesize
252KB
-
Filesize
132KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
192KB
-
Filesize
96KB
-
Filesize
412KB
-
Filesize
444KB
-
Filesize
344KB
-
Filesize
160KB
-
Filesize
144KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
140KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
132KB
-
Filesize
76KB
-
Filesize
72KB
-
Filesize
1.2MB
-
Filesize
176KB
-
Filesize
1.7MB
-
Filesize
368KB
-
Filesize
68KB
-
Filesize
604KB
-
Filesize
72KB
-
Filesize
2.2MB
-
Filesize
1.1MB
-
Filesize
212KB
-
Filesize
148KB
-
Filesize
68KB
-
Filesize
388KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
76KB
-
Filesize
636KB
-
Filesize
1.0MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
164KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
72KB