Analysis
-
max time kernel
0s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 23:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinZip_v10_Beta.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinZip_v10_Beta.exe
Resource
win10v2004-20241007-en
4 signatures
150 seconds
General
-
Target
WinZip_v10_Beta.exe
-
Size
145KB
-
MD5
508e696f10065b0eaac5737cca2a226e
-
SHA1
26a41119d0a255a04b97c08d9ac5728d142f6c07
-
SHA256
01e9404dc0e595e17433240104fc56ecd985d58b112791c738a9df6d5505e253
-
SHA512
bec7a239cfc73896079d8f9ceca35ce34a38582d4426a5ca8c9f13138d2e7e918573f6700652afd7529816021147fa660b3b6af577114bc0bf198227ac850d18
-
SSDEEP
3072:bVJVUmvyCoMhdFI7PYnPq4DZkiitlFukSYR6CML7Gs:h7Jvy67FIMP5D4rXYVKs
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\physicaldrive0 WinZip_v10_Beta.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1540 WinZip_v10_Beta.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1540 WinZip_v10_Beta.exe