Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe
Resource
win10v2004-20241007-en
General
-
Target
f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe
-
Size
499KB
-
MD5
283910a3328f96e657c925d383934e00
-
SHA1
4f0eec51c6bce1bd5709870c51d1c5a5ec46cc77
-
SHA256
f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ce
-
SHA512
69069419f2a38c878edf50673258e0e219f2ad3b929dfc0c86e784f8b4e5f9f4b86abc5e9432681cd623b4f19b3062a55f88dfca891543e668e01266f4d59204
-
SSDEEP
12288:cJUzLBeJqq8N1BB+pCqbX3xDUsVlUMML+e4meWzd:cG3BePm1BB+pZnKsVlUMML+ewg
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1576 f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe 1576 f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1576 wrote to memory of 4792 1576 f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe 89 PID 1576 wrote to memory of 4792 1576 f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe 89 PID 1576 wrote to memory of 4792 1576 f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe 89 PID 1576 wrote to memory of 2992 1576 f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe 93 PID 1576 wrote to memory of 2992 1576 f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe 93 PID 1576 wrote to memory of 2992 1576 f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe"C:\Users\Admin\AppData\Local\Temp\f7f8100fbc4db0c8bea6c7d3595285e428b0b4c4cc6f86e453bf1f78fcce74ceN.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\wscript.exewscript.exe /B "\bcbachh.jse" FirstSetup2⤵
- System Location Discovery: System Language Discovery
PID:4792
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$dmsf.bat2⤵
- System Location Discovery: System Language Discovery
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
311B
MD5e5b603d294a75ab442bc5fc2cf2e2d98
SHA1b8485ad74eaf5bfd314a09c9535bf37e5298217e
SHA2565257067e14f8d9a1648ef15118a1d817e828f1e8165b46d1f718a16564841b58
SHA512ce2f13df4e25ccb7de43cca0994b29b2e5cb66bb66c7dce9dfdd2327940ce6b0b74e223a06059f965ddf5f28d5492f0795cbbe5116a140ad49107782af5f34a3