Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 12:43

General

  • Target

    7c8aaf50b9f6bceca6c4e2292ffc5369871482b256b0cb9592966207e2714e2e.exe

  • Size

    837KB

  • MD5

    6c97fab326463c963510dc8de2867346

  • SHA1

    d311c8ebba3f458d0138f66aa14fbea2919499a2

  • SHA256

    7c8aaf50b9f6bceca6c4e2292ffc5369871482b256b0cb9592966207e2714e2e

  • SHA512

    894c005e51fd5af6b165cfb76a47d104c27e2ebc3ba3a6ad0fc8ad0339f24585ed427d59dbc9bb41971f174ba3407bede35e3a17d5bc27f8fbca059370519ab7

  • SSDEEP

    12288:/qe8v4OkogFXngxVB3n9IEU95uyTva9rdbbeL5YR4NqavVJK8:/qe8zkB6BN2HTva9ZWKqn+8

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c8aaf50b9f6bceca6c4e2292ffc5369871482b256b0cb9592966207e2714e2e.exe
    "C:\Users\Admin\AppData\Local\Temp\7c8aaf50b9f6bceca6c4e2292ffc5369871482b256b0cb9592966207e2714e2e.exe"
    1⤵
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    PID:1128

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads