7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

Analysis

max time kernel
410s
max time network
1134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

796KB
MD5

4b94b989b0fe7bec6311153b309dfe81
SHA1

bb50a4bb8a66f0105c5b74f32cd114c672010b22
SHA256

7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659
SHA512

fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d
SSDEEP

12288:jHeLH6iTPSE54sgweI9oaQaj3T+piq+77xOZ+eMm:jHeLHdTSEeyoaQaj3apiq+77xd

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	pastebin.com
17	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
456	Bootstrapper.exe
456	Bootstrapper.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	456	Bootstrapper.exe
Token: SeShutdownPrivilege	3568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3568	msiexec.exe
Token: SeSecurityPrivilege	3036	msiexec.exe
Token: SeCreateTokenPrivilege	3568	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3568	msiexec.exe
Token: SeLockMemoryPrivilege	3568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3568	msiexec.exe
Token: SeMachineAccountPrivilege	3568	msiexec.exe
Token: SeTcbPrivilege	3568	msiexec.exe
Token: SeSecurityPrivilege	3568	msiexec.exe
Token: SeTakeOwnershipPrivilege	3568	msiexec.exe
Token: SeLoadDriverPrivilege	3568	msiexec.exe
Token: SeSystemProfilePrivilege	3568	msiexec.exe
Token: SeSystemtimePrivilege	3568	msiexec.exe
Token: SeProfSingleProcessPrivilege	3568	msiexec.exe
Token: SeIncBasePriorityPrivilege	3568	msiexec.exe
Token: SeCreatePagefilePrivilege	3568	msiexec.exe
Token: SeCreatePermanentPrivilege	3568	msiexec.exe
Token: SeBackupPrivilege	3568	msiexec.exe
Token: SeRestorePrivilege	3568	msiexec.exe
Token: SeShutdownPrivilege	3568	msiexec.exe
Token: SeDebugPrivilege	3568	msiexec.exe
Token: SeAuditPrivilege	3568	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3568	msiexec.exe
Token: SeChangeNotifyPrivilege	3568	msiexec.exe
Token: SeRemoteShutdownPrivilege	3568	msiexec.exe
Token: SeUndockPrivilege	3568	msiexec.exe
Token: SeSyncAgentPrivilege	3568	msiexec.exe
Token: SeEnableDelegationPrivilege	3568	msiexec.exe
Token: SeManageVolumePrivilege	3568	msiexec.exe
Token: SeImpersonatePrivilege	3568	msiexec.exe
Token: SeCreateGlobalPrivilege	3568	msiexec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 3568	456	Bootstrapper.exe	99
PID 456 wrote to memory of 3568	456	Bootstrapper.exe	99

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3568

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
8.0MB

MD5
50f450d241e1d5a426e1690836ce457f

SHA1
1acba263f2bad2e933a2a98e172fbb738656787c

SHA256
2b758e94a4a5952eb6164b78f0a1f337bea22b6883bd9393e5229da21b3e3a03

SHA512
48753f419478d702ffcf97965045c3d4ed0ce725aa33bba2a2f9abfb1a82aee37784712c4fffbd5e71d74052a1d78e8b24bf996b1fef9c7e13bc0b34d490b515

Download Submit
memory/456-1-0x00007FFFCDA13000-0x00007FFFCDA15000-memory.dmp

Filesize
8KB

Download
memory/456-0-0x000001DC74810000-0x000001DC748DE000-memory.dmp

Filesize
824KB

Download
memory/456-2-0x00007FFFCDA10000-0x00007FFFCE4D1000-memory.dmp

Filesize
10.8MB

Download
memory/456-4-0x000001DC76F30000-0x000001DC76F52000-memory.dmp

Filesize
136KB

Download
memory/456-5-0x00007FFFCDA13000-0x00007FFFCDA15000-memory.dmp

Filesize
8KB

Download
memory/456-6-0x00007FFFCDA10000-0x00007FFFCE4D1000-memory.dmp

Filesize
10.8MB

Download
memory/456-9-0x000001DC770A0000-0x000001DC770AA000-memory.dmp

Filesize
40KB

Download
memory/456-11-0x000001DC770D0000-0x000001DC770E2000-memory.dmp

Filesize
72KB

Download
memory/456-415-0x00007FFFCDA10000-0x00007FFFCE4D1000-memory.dmp

Filesize
10.8MB

Download