Analysis
- max time kernel
7s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
12/05/2024, 07:57
Errors
Reason
Machine shutdown
General
- Target MalwareRepository-main/Spark.exe
- Size 495KB
- Sample240512-jtkd2aag78
- SHA256 55bfcb784904477ef62ef7e4994dee42f03d69bfec3591989513cccbba3fc8fe
Score
9/10
Malware Config
Signatures
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\Spark.exe"C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\Spark.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" -set nointegritychecks on2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" -set testsigning on2⤵
- Modifies boot configuration data using bcdedit
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DLL.dll
memory/1544-0-0x00000000744EE000-0x00000000744EF000-memory.dmp
memory/1544-1-0x00000000001F0000-0x0000000000270000-memory.dmp
memory/1544-2-0x00000000050E0000-0x0000000005686000-memory.dmp
memory/1544-3-0x0000000004CF0000-0x0000000004D82000-memory.dmp
memory/1544-8-0x0000000004FF0000-0x0000000005044000-memory.dmp
memory/1544-9-0x00000000744E0000-0x0000000074C91000-memory.dmp