Analysis
-
max time kernel
64s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
Bootstrapper.exe
-
Size
795KB
-
MD5
a7f3293b177a63f6c50b5560e729cbff
-
SHA1
4885073e4881cffc5c5155de720aa65755418fe8
-
SHA256
da17868f107954124c0953fd1cb37ac8ed4e78460905e83d6402b966a77ee7dc
-
SHA512
70b3431b238457a24e66914d0059e7e8e2dc4f79ac49c9a9c510214b8bc1279af6947288442060ac02c3cf3c863c144ef95219006097d2e59183586f7f701438
-
SSDEEP
12288:Hs0xF36Z1LyI6QQsJNOoRQ1jt/Nppxu29CHWzO:xxJ6Z1L5J8oRQ1jt/Nppxv9C2
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2816 2672 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bootstrapper.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2640 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2672 Bootstrapper.exe Token: SeDebugPrivilege 2640 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe 2640 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2816 2672 Bootstrapper.exe 32 PID 2672 wrote to memory of 2816 2672 Bootstrapper.exe 32 PID 2672 wrote to memory of 2816 2672 Bootstrapper.exe 32 PID 2672 wrote to memory of 2816 2672 Bootstrapper.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 6162⤵
- Program crash
PID:2816
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2640