Analysis
-
max time kernel
2s -
max time network
3s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 23:21
Static task
static1
Behavioral task
behavioral1
Sample
WinZip_v10_Beta.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
WinZip_v10_Beta.exe
Resource
win10v2004-20241007-en
Errors
General
-
Target
WinZip_v10_Beta.exe
-
Size
145KB
-
MD5
508e696f10065b0eaac5737cca2a226e
-
SHA1
26a41119d0a255a04b97c08d9ac5728d142f6c07
-
SHA256
01e9404dc0e595e17433240104fc56ecd985d58b112791c738a9df6d5505e253
-
SHA512
bec7a239cfc73896079d8f9ceca35ce34a38582d4426a5ca8c9f13138d2e7e918573f6700652afd7529816021147fa660b3b6af577114bc0bf198227ac850d18
-
SSDEEP
3072:bVJVUmvyCoMhdFI7PYnPq4DZkiitlFukSYR6CML7Gs:h7Jvy67FIMP5D4rXYVKs
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\physicaldrive0 WinZip_v10_Beta.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinZip_v10_Beta.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4360 WinZip_v10_Beta.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 4360 WinZip_v10_Beta.exe