Analysis

  • max time kernel
    141s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 21:26

General

  • Target

    f4ec4234767ef94ed013320727254216c141bc8612cbc3d83e28b5c94ddb39aa.exe

  • Size

    1.0MB

  • MD5

    95efdc1c5013fed14f8b89a2f0ed0dfd

  • SHA1

    d403544c0eb992522301948004465c453b78c2b3

  • SHA256

    f4ec4234767ef94ed013320727254216c141bc8612cbc3d83e28b5c94ddb39aa

  • SHA512

    db29d5d7fca7d8e01076b7e4022d5a3ce8c91b6ac46120e5311c6ede44ac5fd7d8778d30dc6e2e51e44499e544aa19406e7297d7801e81ed74cebcc478f277c7

  • SSDEEP

    24576:A9dNUQFgv1LBrTTjkkuUCxPHsyILO3HCpxlunGe:ArN9GvvrPSx0bLOSpx8

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4ec4234767ef94ed013320727254216c141bc8612cbc3d83e28b5c94ddb39aa.exe
    "C:\Users\Admin\AppData\Local\Temp\f4ec4234767ef94ed013320727254216c141bc8612cbc3d83e28b5c94ddb39aa.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:1508

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1508-0-0x00000000006C0000-0x00000000006C1000-memory.dmp

          Filesize

          4KB

        • memory/1508-1-0x0000000002450000-0x00000000024C0000-memory.dmp

          Filesize

          448KB

        • memory/1508-2-0x0000000000400000-0x000000000046F000-memory.dmp

          Filesize

          444KB

        • memory/1508-3-0x0000000000400000-0x000000000050F000-memory.dmp

          Filesize

          1.1MB

        • memory/1508-4-0x0000000000400000-0x000000000050F000-memory.dmp

          Filesize

          1.1MB

        • memory/1508-5-0x00000000006C0000-0x00000000006C1000-memory.dmp

          Filesize

          4KB

        • memory/1508-8-0x0000000000400000-0x000000000046F000-memory.dmp

          Filesize

          444KB