Analysis

  • max time kernel
    91s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 02:32

General

  • Target

    ae1084e8853c36c671b9d9fd93a519b04ba332e57060614d65d25f2d1c7dcef4.exe

  • Size

    10.6MB

  • MD5

    08f2d7b3791446e4bdc97fff4ddede75

  • SHA1

    ef86500811def690b2c08e2e92aea70c2cd87b8c

  • SHA256

    ae1084e8853c36c671b9d9fd93a519b04ba332e57060614d65d25f2d1c7dcef4

  • SHA512

    3b4b25d0a8292cbf7ee8f3080cd3b92bfe5a7139ff43650658225217da3309109179f89cc6d98a92ae13ca9521fafdf57b792b43ab6f1ebbd501a664c8334221

  • SSDEEP

    196608:Z/GmBUoyVul6EPHecAc6I3jOXiD5yperUJ3A3fxOgXRMUT9uI:9GmRyolRgc6HcrUwJ/eUT9J

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae1084e8853c36c671b9d9fd93a519b04ba332e57060614d65d25f2d1c7dcef4.exe
    "C:\Users\Admin\AppData\Local\Temp\ae1084e8853c36c671b9d9fd93a519b04ba332e57060614d65d25f2d1c7dcef4.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3012

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3012-0-0x0000000000400000-0x00000000016FC000-memory.dmp

          Filesize

          19.0MB

        • memory/3012-2-0x0000000001D40000-0x0000000001D41000-memory.dmp

          Filesize

          4KB

        • memory/3012-26-0x00000000035E0000-0x00000000035E1000-memory.dmp

          Filesize

          4KB

        • memory/3012-33-0x0000000003600000-0x0000000003617000-memory.dmp

          Filesize

          92KB

        • memory/3012-28-0x0000000003600000-0x0000000003617000-memory.dmp

          Filesize

          92KB

        • memory/3012-27-0x00000000035F0000-0x00000000035F1000-memory.dmp

          Filesize

          4KB

        • memory/3012-25-0x00000000035D0000-0x00000000035D1000-memory.dmp

          Filesize

          4KB

        • memory/3012-24-0x00000000035C0000-0x00000000035C1000-memory.dmp

          Filesize

          4KB

        • memory/3012-23-0x00000000035B0000-0x00000000035B1000-memory.dmp

          Filesize

          4KB

        • memory/3012-22-0x00000000035A0000-0x00000000035A1000-memory.dmp

          Filesize

          4KB

        • memory/3012-21-0x0000000003590000-0x0000000003591000-memory.dmp

          Filesize

          4KB

        • memory/3012-20-0x0000000003580000-0x0000000003581000-memory.dmp

          Filesize

          4KB

        • memory/3012-19-0x0000000003570000-0x0000000003571000-memory.dmp

          Filesize

          4KB

        • memory/3012-17-0x0000000003550000-0x0000000003551000-memory.dmp

          Filesize

          4KB

        • memory/3012-16-0x0000000003540000-0x0000000003541000-memory.dmp

          Filesize

          4KB

        • memory/3012-14-0x0000000003520000-0x0000000003521000-memory.dmp

          Filesize

          4KB

        • memory/3012-18-0x0000000003560000-0x0000000003561000-memory.dmp

          Filesize

          4KB

        • memory/3012-15-0x0000000003530000-0x0000000003531000-memory.dmp

          Filesize

          4KB

        • memory/3012-13-0x0000000003510000-0x0000000003511000-memory.dmp

          Filesize

          4KB

        • memory/3012-12-0x0000000003500000-0x0000000003501000-memory.dmp

          Filesize

          4KB

        • memory/3012-11-0x00000000034F0000-0x00000000034F1000-memory.dmp

          Filesize

          4KB

        • memory/3012-10-0x00000000034E0000-0x00000000034E1000-memory.dmp

          Filesize

          4KB

        • memory/3012-9-0x00000000034D0000-0x00000000034D1000-memory.dmp

          Filesize

          4KB

        • memory/3012-8-0x00000000006B2000-0x0000000000C5D000-memory.dmp

          Filesize

          5.7MB

        • memory/3012-7-0x00000000034C0000-0x00000000034C1000-memory.dmp

          Filesize

          4KB

        • memory/3012-6-0x00000000034B0000-0x00000000034B1000-memory.dmp

          Filesize

          4KB

        • memory/3012-5-0x00000000034A0000-0x00000000034A1000-memory.dmp

          Filesize

          4KB

        • memory/3012-4-0x0000000003490000-0x0000000003491000-memory.dmp

          Filesize

          4KB

        • memory/3012-3-0x0000000001D50000-0x0000000001D51000-memory.dmp

          Filesize

          4KB

        • memory/3012-1-0x00000000017A0000-0x00000000017A1000-memory.dmp

          Filesize

          4KB

        • memory/3012-37-0x0000000000400000-0x00000000016FC000-memory.dmp

          Filesize

          19.0MB

        • memory/3012-38-0x0000000000400000-0x00000000016FC000-memory.dmp

          Filesize

          19.0MB

        • memory/3012-39-0x00000000006B2000-0x0000000000C5D000-memory.dmp

          Filesize

          5.7MB

        • memory/3012-40-0x0000000000400000-0x00000000016FC000-memory.dmp

          Filesize

          19.0MB