Analysis
-
max time kernel
110s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2024 01:04
Static task
static1
Behavioral task
behavioral1
Sample
f16396e91e8f1eb8d584f98cabfeb080N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f16396e91e8f1eb8d584f98cabfeb080N.exe
Resource
win10v2004-20240802-en
General
-
Target
f16396e91e8f1eb8d584f98cabfeb080N.exe
-
Size
544KB
-
MD5
f16396e91e8f1eb8d584f98cabfeb080
-
SHA1
ee3583b1ff4bd77ccedbd588ca09bfee98fbe4dd
-
SHA256
325a52ba675ea50d7cbf9393e77ed65ba2621e233aa75d53fe4bbc8b297c4f18
-
SHA512
6a3b565a91e48e3a2e478608496e16d9ec39a33419d3edaf86febb3f0a64d4e45a8caf740c0b4fd26f536b2d0116a6df1cf3bcbdbcc8f1a4a16f3f31399e6ee9
-
SSDEEP
12288:/aNwFE9X/058fQcv6jbrzf9utdor1fqzxZiVTlSG:/aOAX/LWf9utmrY2FR
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 f16396e91e8f1eb8d584f98cabfeb080N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f16396e91e8f1eb8d584f98cabfeb080N.exe