Analysis

  • max time kernel
    26s
  • max time network
    29s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 01:54

Errors

Reason
Machine shutdown

General

  • Target

    Main.exe

  • Size

    490KB

  • MD5

    3d3fd6ab526222a7ea7ff15a6ad9a866

  • SHA1

    f8d94097ce3133042028e31ab38b5d93fc2295a0

  • SHA256

    e3b395c10b7e2dbb8969869b7b6d3a030239c4fb09dc7ed2853fa65da73a6d34

  • SHA512

    3a8da5b6936b93a7dcf4785ecf81ee8602cd83fbb71f5ccea573e342f925f89659d2f88341c77b07cf0a53cdb14fb7bcb7fceb1d7d48361102cacafe343ad936

  • SSDEEP

    12288:WbVgCOJxg/enrr3kNUXhMFr934Zr87sv5jRCu0CfgMcEiP/3IWVJ/Vxgcx9n:WbVgCOJxgCMUZr87srA/1

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Main.exe
    "C:\Users\Admin\AppData\Local\Temp\Main.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:2412
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:3064
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2460

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2412-0-0x0000000000400000-0x000000000044B000-memory.dmp

        Filesize

        300KB

      • memory/2412-1-0x0000000000400000-0x000000000044B000-memory.dmp

        Filesize

        300KB

      • memory/2460-3-0x0000000002B30000-0x0000000002B31000-memory.dmp

        Filesize

        4KB

      • memory/3064-2-0x0000000002E10000-0x0000000002E11000-memory.dmp

        Filesize

        4KB