93bc6d23db7e7e352ffdfcd1e0a05061e0cda36085704b93e90936de1da0bccc

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

115br.exe
Size

1.6MB
MD5

4cd4cfb9ad069a18d834803ef4d36ceb
SHA1

61c29a5e4d201e8ff9539404d3005e5581fe6bff
SHA256

2f220204af41b0556a327887c7b66ce3f560de81ce2aed84f132408a50274095
SHA512

6e1e079b9941dc7beba5cba2ce92a7689862b0a548170ca31e9b961d7119ae1d2f409163e709551a61201174244dbde7119441d58befde09e403bcb1e773209b
SSDEEP

24576:waZEBO/8Iv+slDbDPbrhIBoldgOJaEGHTchNGgU3Oycyz9O8VFuuzgfCAHZ:wXk8I9hOE4QNGgU3Oyc29Oy7zgfCA5

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	115br.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\115br.exe = "0"	115br.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	115br.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\115br.exe = "0"	115br.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	115br.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1200	115br.exe
Token: SeIncBasePriorityPrivilege	1200	115br.exe

C:\Users\Admin\AppData\Local\Temp\115br.exe
"C:\Users\Admin\AppData\Local\Temp\115br.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cfg.ini

Filesize
182B

MD5
e2d271313680bc6861946c5f6fcc6913

SHA1
752b453e6b908c94fd48d6bf6407e551c77af85d

SHA256
f4923728eae1167d79f8415e45455c84f3420d108152da3745381372a69c912d

SHA512
14f1252bbffc4891399fa620a5c1b067ad461bcd968494eb8369dfed2f710ba9b00b78dce6d4266b68f6bc255d90ba2d8a2d3fda28e4d43ba3215f29942d47e4

Download Submit
memory/1200-96-0x00000000372D0000-0x00000000372E0000-memory.dmp

Filesize
64KB

Download
memory/1200-99-0x0000000004060000-0x0000000004061000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads