Analysis

  • max time kernel
    6s
  • max time network
    7s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11-06-2024 12:47

Errors

Reason
Machine shutdown

General

  • Target

    2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe

  • Size

    720KB

  • MD5

    28c80739400645b392c9ec6ac2c3fcd4

  • SHA1

    0b0349a348e8f83e8de11192d66b6ed0ce3e6166

  • SHA256

    e9843f3485755bf3f2bb45c8252dd5df87f7c943840c65a05143442d04f9672c

  • SHA512

    59cd587b4d40d842f6f4ce6fe2f95ad9b422fd7c72729585f2102ef539c24aaf99598f6b3df5f36ba831e2aefa733e6dfde8d693e4b11a2e49a05148e95a04a4

  • SSDEEP

    12288:SaSuG9f+BgntpABY2ATt2rwTZni5KytexQvt:SaWf+enjABY2Ax2rwTZiUyteM

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe"
    1⤵
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1856
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1252
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2312

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1252-2-0x0000000002F10000-0x0000000002F11000-memory.dmp

        Filesize

        4KB

      • memory/2312-3-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

        Filesize

        4KB