Analysis
-
max time kernel
6s -
max time network
7s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 12:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe
Resource
win10v2004-20240508-en
Errors
General
-
Target
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe
-
Size
720KB
-
MD5
28c80739400645b392c9ec6ac2c3fcd4
-
SHA1
0b0349a348e8f83e8de11192d66b6ed0ce3e6166
-
SHA256
e9843f3485755bf3f2bb45c8252dd5df87f7c943840c65a05143442d04f9672c
-
SHA512
59cd587b4d40d842f6f4ce6fe2f95ad9b422fd7c72729585f2102ef539c24aaf99598f6b3df5f36ba831e2aefa733e6dfde8d693e4b11a2e49a05148e95a04a4
-
SSDEEP
12288:SaSuG9f+BgntpABY2ATt2rwTZni5KytexQvt:SaWf+enjABY2Ax2rwTZiUyteM
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Program Files\\System.dll" 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exedescription ioc process File opened for modification \??\physicaldrive0 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe -
Drops file in Program Files directory 3 IoCs
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exedescription ioc process File created C:\Program Files\System.dll 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe File opened for modification C:\Program Files\System.dll 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe File created C:\Program Files\360.dll 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exedescription pid process Token: SeShutdownPrivilege 1856 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exepid process 1856 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe 1856 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe"1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1856
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1252
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2312