Analysis
- max time kernel
143s - max time network
126s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
13/03/2024, 22:32
General
- Target c704d2f8ab334be8b696362070dde009.exe
- Size 448KB
- Sample240313-2gaceaba5y
- SHA256 be36110b840d8c51e934bc698ba144bba38a26dcc09626ea6551c51be864e253
Malware Config
Signatures
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Windows directory 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c704d2f8ab334be8b696362070dde009.exe"C:\Users\Admin\AppData\Local\Temp\c704d2f8ab334be8b696362070dde009.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\EntSver.exeC:\Windows\EntSver.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
EntSver.exe
memory/2040-148-0x0000000000400000-0x00000000004F8000-memory.dmp
memory/2404-0-0x00000000003B0000-0x00000000003F3000-memory.dmp
memory/2404-17-0x0000000002040000-0x0000000002041000-memory.dmp
memory/2404-42-0x0000000002600000-0x0000000002601000-memory.dmp
memory/2404-53-0x00000000025D0000-0x00000000025D1000-memory.dmp
memory/2404-52-0x0000000000530000-0x0000000000531000-memory.dmp
memory/2404-51-0x0000000002680000-0x0000000002681000-memory.dmp
memory/2404-54-0x0000000002630000-0x0000000002631000-memory.dmp
memory/2404-50-0x0000000002690000-0x0000000002691000-memory.dmp
memory/2404-49-0x0000000002660000-0x0000000002661000-memory.dmp
memory/2404-48-0x0000000002670000-0x0000000002671000-memory.dmp
memory/2404-47-0x0000000002640000-0x0000000002641000-memory.dmp
memory/2404-46-0x0000000002650000-0x0000000002651000-memory.dmp
memory/2404-45-0x0000000002620000-0x0000000002621000-memory.dmp
memory/2404-44-0x00000000025E0000-0x00000000025E1000-memory.dmp
memory/2404-43-0x00000000025F0000-0x00000000025F1000-memory.dmp
memory/2404-41-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/2404-40-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/2404-39-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/2404-38-0x0000000002580000-0x0000000002581000-memory.dmp
memory/2404-37-0x0000000002590000-0x0000000002591000-memory.dmp
memory/2404-36-0x0000000002560000-0x0000000002561000-memory.dmp
memory/2404-35-0x0000000002570000-0x0000000002571000-memory.dmp
memory/2404-34-0x0000000002540000-0x0000000002541000-memory.dmp
memory/2404-33-0x0000000002550000-0x0000000002551000-memory.dmp
memory/2404-32-0x0000000002520000-0x0000000002521000-memory.dmp
memory/2404-58-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/2404-65-0x0000000003200000-0x0000000003201000-memory.dmp
memory/2404-64-0x00000000031D0000-0x00000000031D1000-memory.dmp
memory/2404-63-0x00000000031E0000-0x00000000031E1000-memory.dmp
memory/2404-62-0x00000000031B0000-0x00000000031B1000-memory.dmp
memory/2404-61-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/2404-60-0x0000000003190000-0x0000000003191000-memory.dmp
memory/2404-59-0x0000000002700000-0x0000000002701000-memory.dmp
memory/2404-55-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2404-31-0x0000000002530000-0x0000000002531000-memory.dmp
memory/2404-30-0x0000000002500000-0x0000000002501000-memory.dmp
memory/2404-29-0x0000000002510000-0x0000000002511000-memory.dmp
memory/2404-28-0x00000000020D0000-0x00000000020D1000-memory.dmp
memory/2404-27-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/2404-26-0x00000000020B0000-0x00000000020B1000-memory.dmp
memory/2404-25-0x00000000020C0000-0x00000000020C1000-memory.dmp
memory/2404-24-0x0000000002090000-0x0000000002091000-memory.dmp
memory/2404-23-0x00000000020A0000-0x00000000020A1000-memory.dmp
memory/2404-22-0x0000000002070000-0x0000000002071000-memory.dmp
memory/2404-21-0x0000000002080000-0x0000000002081000-memory.dmp
memory/2404-20-0x0000000002050000-0x0000000002051000-memory.dmp
memory/2404-19-0x0000000002060000-0x0000000002061000-memory.dmp
memory/2404-18-0x0000000002030000-0x0000000002031000-memory.dmp
memory/2404-16-0x0000000000610000-0x0000000000611000-memory.dmp
memory/2404-15-0x0000000000620000-0x0000000000621000-memory.dmp
memory/2404-14-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/2404-13-0x0000000000600000-0x0000000000601000-memory.dmp
memory/2404-12-0x00000000005D0000-0x00000000005D1000-memory.dmp
memory/2404-11-0x00000000005E0000-0x00000000005E1000-memory.dmp
memory/2404-10-0x0000000000590000-0x0000000000591000-memory.dmp
memory/2404-9-0x0000000000550000-0x0000000000551000-memory.dmp
memory/2404-8-0x0000000000540000-0x0000000000541000-memory.dmp
memory/2404-7-0x0000000000580000-0x0000000000581000-memory.dmp
memory/2404-6-0x0000000000560000-0x0000000000561000-memory.dmp
memory/2404-5-0x0000000000570000-0x0000000000573000-memory.dmp
memory/2404-4-0x00000000003A0000-0x00000000003A1000-memory.dmp
memory/2404-3-0x0000000000250000-0x0000000000251000-memory.dmp
memory/2404-2-0x0000000000260000-0x0000000000261000-memory.dmp
memory/2404-1-0x0000000000510000-0x0000000000511000-memory.dmp
memory/2404-146-0x0000000000400000-0x00000000004F8000-memory.dmp