Analysis
-
max time kernel
141s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26-05-2024 13:30
General
-
Target
f058ce9b51ebdd8cded5cd799ca06cd6f1164f46956a0e125b3c0725f4fbe624.exe
-
Size
7.9MB
-
MD5
1d17a6b8be9c7747d29a8119092a2c65
-
SHA1
98b582ae8fd9c03acf7b8b373258010f0dd0b9fd
-
SHA256
f058ce9b51ebdd8cded5cd799ca06cd6f1164f46956a0e125b3c0725f4fbe624
-
SHA512
e32b83757c1d8d50ccd3eded560c78ecb13594047a3cf195b711ec28f9ebda3d942812babf0071e2df1908069b620126008528923123f372fcb4162329ade3a4
-
SSDEEP
196608:mtWofdR+aXdZ7956XZ+3YtzsY6wgjMX9F9u948KqYjEie0tW:9ofdRzX798J+tF7jk9P8Ks
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Modifies Control Panel 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f058ce9b51ebdd8cded5cd799ca06cd6f1164f46956a0e125b3c0725f4fbe624.exe"C:\Users\Admin\AppData\Local\Temp\f058ce9b51ebdd8cded5cd799ca06cd6f1164f46956a0e125b3c0725f4fbe624.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
4KB