Analysis
-
max time kernel
136s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-08-2024 23:15
General
-
Target
0417c9a82cb9c893ec109f6c40ec8f718fce2ba7f88358c8fda8e895c20578a3.exe
-
Size
1.8MB
-
MD5
3624f9d91e71ea8136fcafbbb7518ef9
-
SHA1
4e6962aefe64b33a3f32d40d625e31bf9edf344f
-
SHA256
0417c9a82cb9c893ec109f6c40ec8f718fce2ba7f88358c8fda8e895c20578a3
-
SHA512
a5b3b1e43e962ca4e9a21eba77112e72c55ab4bb9bed7d2490976fc47ad606bb4f2e78628cb6944d46d046cce01fe093c2c28ba5e6f50e33c47ebc62460a662d
-
SSDEEP
49152:OOZ0yvcF6nNEfn22cie2nVXdx14rD18LDPL/cah:OOZ0yvcF6nyTcieCVNn4rD18Xj/ca
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0417c9a82cb9c893ec109f6c40ec8f718fce2ba7f88358c8fda8e895c20578a3.exe"C:\Users\Admin\AppData\Local\Temp\0417c9a82cb9c893ec109f6c40ec8f718fce2ba7f88358c8fda8e895c20578a3.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery