Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 19:31

General

  • Target

    20321ae083f2ec8920a961f72d4b63b7c7280d04e282c35197ab7d432e0357ab.exe

  • Size

    483KB

  • MD5

    ea05c80e9344b0fe64d8082069bac5c9

  • SHA1

    e4e3d29966e9d364616bd18cd0049c8f2a32bea7

  • SHA256

    20321ae083f2ec8920a961f72d4b63b7c7280d04e282c35197ab7d432e0357ab

  • SHA512

    d2d6188e33fcc5133d20017d2d41b674079b5d70f90aad8c58ab597e2df8bc7824bb17d939d613e424e0797a5e2c06d7a1d60a2ada20e28eb01e18ec0568f952

  • SSDEEP

    12288:fJkBTN5tYK6M+e7iAq3xaUBIS8vy+Oz6mRZM:uBBbv6M+eIaUKsVmmw

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\20321ae083f2ec8920a961f72d4b63b7c7280d04e282c35197ab7d432e0357ab.exe
    "C:\Users\Admin\AppData\Local\Temp\20321ae083f2ec8920a961f72d4b63b7c7280d04e282c35197ab7d432e0357ab.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    PID:4048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4048-1-0x0000000000730000-0x0000000000830000-memory.dmp

    Filesize

    1024KB

  • memory/4048-2-0x0000000000930000-0x000000000099B000-memory.dmp

    Filesize

    428KB

  • memory/4048-3-0x0000000000400000-0x000000000046F000-memory.dmp

    Filesize

    444KB

  • memory/4048-4-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/4048-5-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/4048-7-0x0000000000730000-0x0000000000830000-memory.dmp

    Filesize

    1024KB

  • memory/4048-8-0x0000000000930000-0x000000000099B000-memory.dmp

    Filesize

    428KB

  • memory/4048-9-0x0000000000400000-0x000000000046F000-memory.dmp

    Filesize

    444KB