Analysis
-
max time kernel
1s -
max time network
3s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 17:28
Behavioral task
behavioral1
Sample
bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exe
Resource
win10v2004-20240412-en
Errors
General
-
Target
bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exe
-
Size
81KB
-
MD5
68d21e42ba35dc6324c75da71233ea14
-
SHA1
f5c5c50336d9239e1765bd1f8ca50d9c3c27612f
-
SHA256
bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2
-
SHA512
e76a537f59ad2230f646e050e2217667019f6656243ece09fdf0f834a84b5b02f643ad25fc3b92a17409de6928d308ed70cbb521c4b0037c6e60b7ec04687b0b
-
SSDEEP
1536:qn/9ecG8JnbijvBWya/1wpdN2YWL2MRxisBELCjTV1ExZ47pVUdsRGhSF:q/MPCbMvI9idspL2grTye7rUM
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1452-0-0x00007FF67B0E0000-0x00007FF67B110000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exedescription ioc process File opened for modification \??\PhysicalDrive0 bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exedescription pid process Token: SeDebugPrivilege 1452 bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exe Token: SeShutdownPrivilege 1452 bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exe"C:\Users\Admin\AppData\Local\Temp\bd42105b082987624faae1216dcb8c20e48c25566f0cc808cdd22cbdd273f2f2.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:1452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1452-0-0x00007FF67B0E0000-0x00007FF67B110000-memory.dmpFilesize
192KB