Analysis

  • max time kernel
    92s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 11:56

General

  • Target

    186dfc67dd8fa85fa4938b11a84dea7bc2fccf22c65c1c37ff4fbdea22c5d6dd.exe

  • Size

    729KB

  • MD5

    303aa88b6eb606a7f9c1c27c5d4f11cc

  • SHA1

    2084aa0f2fcfc74eb5f0e74356ef56c8e25c9b80

  • SHA256

    186dfc67dd8fa85fa4938b11a84dea7bc2fccf22c65c1c37ff4fbdea22c5d6dd

  • SHA512

    f36ef154a0b1817b60264de1b3f7f49cf9ec10ac5765be4c77de33c6e29a1fba1dc99c3a4ff451f851fb6893c55a82294e9962cc16ffb799006e6e02e8afbd74

  • SSDEEP

    12288:kd0MtTl9pasdKSMPgtFP+dkcy7wZu2z3LClq3BVRrGzd94rbgT/i5DDPThBBfafR:kTp6nz3ez4Aad6d6BHUfATzLKMceJfG5

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\186dfc67dd8fa85fa4938b11a84dea7bc2fccf22c65c1c37ff4fbdea22c5d6dd.exe
    "C:\Users\Admin\AppData\Local\Temp\186dfc67dd8fa85fa4938b11a84dea7bc2fccf22c65c1c37ff4fbdea22c5d6dd.exe"
    1⤵
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    PID:4344

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads