Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26-05-2024 06:44
General
-
Target
1e348e96037b34ee697d3dddd0aa3aff14471765b64ff46cd701f46a33cd5214.exe
-
Size
1.6MB
-
MD5
c22f2a9293b10ace39c77f1b3be56ed6
-
SHA1
3f303cf2b12b101fe87fa8b01cc6e5414e2c5785
-
SHA256
1e348e96037b34ee697d3dddd0aa3aff14471765b64ff46cd701f46a33cd5214
-
SHA512
96efd75ba8c6b0a01290c5c8f4c88ab45e88ed99ad83759e1838ea7621e6418185a0f8401246b0b54cd88d5185bffe0db3818797bc1421d70788637df1424486
-
SSDEEP
49152:V4SjpxYFwps45SaRTc0Hzoss+l0vXKfSas/ouXfK7ouuPyyx:xzY+s4f7Hzjf2vUSTouXS7JYd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e348e96037b34ee697d3dddd0aa3aff14471765b64ff46cd701f46a33cd5214.exe"C:\Users\Admin\AppData\Local\Temp\1e348e96037b34ee697d3dddd0aa3aff14471765b64ff46cd701f46a33cd5214.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-917572.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-917572.dll Bugreport %E7%A7%92%E8%AF%84%E7%A7%92%202⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD59b69ce4fb7eef9f5b2d910c3eb9764e9
SHA19fc853260dc4820af58df2718d17d273b1a634c6
SHA2568218316dd5dfef68af141620abc2dd52e8218191bb5468cee3f2b17bf3a060f7
SHA5129249c694636e01b88fe193dd060d1805bc850036d943e7cae9dc4ba088b2499426620c547d8c210c537e6ae9f30e9055edf46ddbd71d5889466b3929a61c6f83
-
Filesize
81B
MD544f39eda296c09e71b261b027ffd5e4c
SHA10f873aded3b4b685ec778e890e45c0d238010b49
SHA256fb55c9474ec2005bb796aed01c127ef30b3644ff7ca1a553dc48f8151a39847e
SHA512e2f47356e1f0a7876e03dc66928fecea8a39bcefea307adc03eda5c117598a8074e4031e3d49107f583c3b045a734282c5281b48e97e5e1aee47724bbf61ce2c
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
228KB
-
Filesize
228KB