Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/03/2024, 02:55
General
-
Target
bd7d1e0a203111916192ec1c671b6998.exe
-
Size
1.6MB
-
MD5
bd7d1e0a203111916192ec1c671b6998
-
SHA1
1a24c81a1c4d42a4591c75f7a46a253d9cad4cec
-
SHA256
ed7cd15bf8ae6894d25588f18441d3e7c431b8aac6653e57b352d7b5535b0b56
-
SHA512
227d4a5ca4d08dc81120139adf75c6f87e2329c4a0f5055f0faec39a3dd845dff33dac154d327c67796cb27acfa6762666068568d0f95f847ae428e733a3111e
-
SSDEEP
49152:dHKlAdzwgIrkUYSE/kxzHzHm/pdN8IBt69844NQFfqO:dqCRJCHzHkpdKmJCRqO
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd7d1e0a203111916192ec1c671b6998.exe"C:\Users\Admin\AppData\Local\Temp\bd7d1e0a203111916192ec1c671b6998.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB