Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 22:31

General

  • Target

    afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe

  • Size

    8.1MB

  • MD5

    3b72abfc4d86c25cf836f7a099125d6b

  • SHA1

    a96bb7ccff5ed1c4e1d3122296ba02513bcda271

  • SHA256

    afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da

  • SHA512

    7b0bc3c2b12152cda2f17258be13d6a106cc573bc4075604815a3054970f44edea443e2152ceae4ac868a2715307a683ea4b7d423ed9de764ecee8150dda377f

  • SSDEEP

    196608:IOBqNXPh6PQJCGOW255EncW5aIsEi2Z2Qb9CxkgtFeCqXB1CePepQb:jBkPrIGOW3Gz2d9ZcevXz1Pfb

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe
    "C:\Users\Admin\AppData\Local\Temp\afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2856-0-0x0000000000400000-0x0000000000C4B000-memory.dmp

    Filesize

    8.3MB

  • memory/2856-1-0x0000000002B40000-0x000000000338B000-memory.dmp

    Filesize

    8.3MB

  • memory/2856-3-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2856-2-0x0000000002B40000-0x000000000338B000-memory.dmp

    Filesize

    8.3MB

  • memory/2856-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB