Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 19:30
Static task
static1
Behavioral task
behavioral1
Sample
512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe
Resource
win11-20240426-en
General
-
Target
512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe
-
Size
608KB
-
MD5
eba0494775beb78b07f50a3987af7faa
-
SHA1
97369979221f30454a3d9f16317e25eadf467b75
-
SHA256
512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15
-
SHA512
ab3c92da6e14d8a2bd642f73e78869846f37e371d44c2defa2add3270452b0a2e4765c692221490f28a3129a18353adb98c7072cf21601ea0c22175abc3346da
-
SSDEEP
12288:4QPNoKmIstgkjMaULCFCISfYxOS73ICt1WkSVzDeTQz:hoKmZtgkO5ISfYxOi3ICDWkSV2TQz
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3704 set thread context of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3704 wrote to memory of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81 PID 3704 wrote to memory of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81 PID 3704 wrote to memory of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81 PID 3704 wrote to memory of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81 PID 3704 wrote to memory of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81 PID 3704 wrote to memory of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81 PID 3704 wrote to memory of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81 PID 3704 wrote to memory of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81 PID 3704 wrote to memory of 1208 3704 512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe"C:\Users\Admin\AppData\Local\Temp\512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe"C:\Users\Admin\AppData\Local\Temp\512afb173a33e153887848f1b97dc092c5733e619758b82b5f7f5c208aa53e15.exe"2⤵
- Writes to the Master Boot Record (MBR)
PID:1208
-