Analysis

  • max time kernel
    0s
  • max time network
    1s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 23:21

General

  • Target

    WinZip_v10_Beta.exe

  • Size

    145KB

  • MD5

    508e696f10065b0eaac5737cca2a226e

  • SHA1

    26a41119d0a255a04b97c08d9ac5728d142f6c07

  • SHA256

    01e9404dc0e595e17433240104fc56ecd985d58b112791c738a9df6d5505e253

  • SHA512

    bec7a239cfc73896079d8f9ceca35ce34a38582d4426a5ca8c9f13138d2e7e918573f6700652afd7529816021147fa660b3b6af577114bc0bf198227ac850d18

  • SSDEEP

    3072:bVJVUmvyCoMhdFI7PYnPq4DZkiitlFukSYR6CML7Gs:h7Jvy67FIMP5D4rXYVKs

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WinZip_v10_Beta.exe
    "C:\Users\Admin\AppData\Local\Temp\WinZip_v10_Beta.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    PID:1540

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1540-0-0x0000000000402000-0x0000000000404000-memory.dmp

          Filesize

          8KB

        • memory/1540-1-0x00000000005C0000-0x00000000005E0000-memory.dmp

          Filesize

          128KB

        • memory/1540-2-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB