Overview

overview

8

Static

static

1

360TS_Setup_Mini.exe

windows10-1703-x64

8

Analysis

  • max time kernel
    194s
  • max time network
    256s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-es
  • resource tags

    arch:x64arch:x86image:win10-20240404-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    15-06-2024 22:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    360TS_Setup_Mini.exe

  • Size

    1.4MB

  • MD5

    31fee2c73b8d2a8ec979775cd5f5ced7

  • SHA1

    39182a68bc0c1c07d3ddc47cd69fe3692dbac834

  • SHA256

    d26a7f2d4f3521827201e6cdcd296f132c7d18c3a1ce70c24b423300cff326fe

  • SHA512

    db51b602a8675641bc3a0a980a197243787ed12f5e0619cb1d390c91193d7e3447e3e86e2321c3ea273c6732b356003a249241d7d8a5699931810e5a35d5c650

  • SSDEEP

    24576:kL/7n6lbcC8oblv1zj1SqdAGFQZIxvC45UJoe1Z:E6+C8o5tzjYq+ZIxL5UJoeL

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.exe
    "C:\Users\Admin\AppData\Local\Temp\360TS_Setup_Mini.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    Filesize

    653B

    MD5

    9762da1629c6f6e76282d00a0ecb3e23

    SHA1

    ed5600013e3d8c29f1ed85e4dca58795b868f44e

    SHA256

    e00b52797737e088c6213742a4e42e8da58eb0a30decbc219e09ee1ec2576df4

    SHA512

    58d3c304766ed09aaffd2d986f9eb26152e442062f18329ff031b5da0c5008f5ab926ea4ea2a1698a9aa3501baff01ce336f4a8fa7642a1e04cab9c24d34dadc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
    Filesize

    830B

    MD5

    ccc8d9de176911a3194584246c9911a6

    SHA1

    9c3ef9a68250929819a742ea3c476740fd2f230b

    SHA256

    907dc39171aa7b9ab602b113ffd240b2ceef8df590296337242f275edded096e

    SHA512

    1563e6083a9467e56d93d8fdb4c35d25380d7a4695589af4fed94ef9e3bfe2c05b96e3f5082a261da432c0a3a40ee13e0181f5394aeec8108182953b6a432dae

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{B7008368-B356-4ed6-B486-F85C80EE0043}.tmp
    Filesize

    3KB

    MD5

    b1ddd3b1895d9a3013b843b3702ac2bd

    SHA1

    71349f5c577a3ae8acb5fbce27b18a203bf04ede

    SHA256

    46cda5ad256bf373f5ed0b2a20efa5275c1ffd96864c33f3727e76a3973f4b3c

    SHA512

    93e6c10c4a8465bc2e58f4c7eb300860186ddc5734599bcdad130ff9c8fd324443045eac54bbc667b058ac1fa271e5b7645320c6e3fc2f28cc5f824096830de1

    Download Submit

  • \Users\Admin\AppData\Local\Temp\{C8BAB22D-201C-4043-A449-C71E8E3077FD}.tmp\360P2SP.dll
    Filesize

    824KB

    MD5

    fc1796add9491ee757e74e65cedd6ae7

    SHA1

    603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

    SHA256

    bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

    SHA512

    8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

    Download Submit

  • memory/2572-9-0x0000000003040000-0x0000000003041000-memory.dmp

    Filesize

    4KB

    Download