Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 22:31
Static task
static1
Behavioral task
behavioral1
Sample
afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe
Resource
win10v2004-20240508-en
General
-
Target
afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe
-
Size
8.1MB
-
MD5
3b72abfc4d86c25cf836f7a099125d6b
-
SHA1
a96bb7ccff5ed1c4e1d3122296ba02513bcda271
-
SHA256
afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da
-
SHA512
7b0bc3c2b12152cda2f17258be13d6a106cc573bc4075604815a3054970f44edea443e2152ceae4ac868a2715307a683ea4b7d423ed9de764ecee8150dda377f
-
SSDEEP
196608:IOBqNXPh6PQJCGOW255EncW5aIsEi2Z2Qb9CxkgtFeCqXB1CePepQb:jBkPrIGOW3Gz2d9ZcevXz1Pfb
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exedescription ioc process File opened for modification \??\PhysicalDrive0 afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exepid process 4272 afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe 4272 afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe"C:\Users\Admin\AppData\Local\Temp\afddddc55031d8a6a6ce1454a29c12e9ebc5d761c23d688e585bde09bc6691da.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:4272