Analysis
- max time kernel
301s - max time network
282s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
12/05/2024, 07:57
Errors
General
- Target MalwareRepository-main/InfiniteBlue.exe
- Size 1.8MB
- Sample240512-jtkd2aag78
- SHA256 a38f8a7e057e205d3961095a025f5014c0da0567495f2ca5a15f26d89c481026
Malware Config
Signatures
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Modifies file permissions 1 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\InfiniteBlue.exe"C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\InfiniteBlue.exe"1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\takeown.exe"takeown.exe" /f C:\Windows\system32\LogonUI.exe2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2704-0-0x00007FFA379F3000-0x00007FFA379F5000-memory.dmp
memory/2704-1-0x00000200340C0000-0x000002003428A000-memory.dmp
memory/2704-2-0x00007FFA379F0000-0x00007FFA384B2000-memory.dmp
memory/2704-3-0x000002004E970000-0x000002004EC40000-memory.dmp
memory/2704-4-0x00007FFA379F0000-0x00007FFA384B2000-memory.dmp
memory/2704-5-0x00007FFA379F3000-0x00007FFA379F5000-memory.dmp
memory/2704-6-0x00007FFA379F0000-0x00007FFA384B2000-memory.dmp
memory/2704-7-0x00007FFA379F0000-0x00007FFA384B2000-memory.dmp
memory/2704-8-0x00007FFA379F0000-0x00007FFA384B2000-memory.dmp
memory/2704-9-0x00007FFA379F0000-0x00007FFA384B2000-memory.dmp
memory/2704-10-0x00007FFA379F0000-0x00007FFA384B2000-memory.dmp