Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 11:54

General

  • Target

    ba0f56e91b3361a0e8af4ab9cbcdb73a96fa5f63ced325a6591cef180b1fec7e.exe

  • Size

    627KB

  • MD5

    170e0e901546270b7ae38cda8b604329

  • SHA1

    9f4e5ec36af94afcdd55004f06e69421b6996884

  • SHA256

    ba0f56e91b3361a0e8af4ab9cbcdb73a96fa5f63ced325a6591cef180b1fec7e

  • SHA512

    6875de1b7b1b9b93806197f322fa65b854f005829d6ed4e810005c62dac941a6c054f9be2b3e09b4446ec86e8b41712f376385dc152af5ed02e50a69c40b6018

  • SSDEEP

    12288:+/4w250qDEoPgnVZEVBQXJHj/532qXBxOTnzE5Wfq35uhByG4eOZSrtqGr:Rj6o1Pgs+jx3VCTno5+ISrtFr

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba0f56e91b3361a0e8af4ab9cbcdb73a96fa5f63ced325a6591cef180b1fec7e.exe
    "C:\Users\Admin\AppData\Local\Temp\ba0f56e91b3361a0e8af4ab9cbcdb73a96fa5f63ced325a6591cef180b1fec7e.exe"
    1⤵
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    PID:2288

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads