Analysis

  • max time kernel
    2s
  • max time network
    3s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 23:21

Errors

Reason
Machine shutdown

General

  • Target

    WinZip_v10_Beta.exe

  • Size

    145KB

  • MD5

    508e696f10065b0eaac5737cca2a226e

  • SHA1

    26a41119d0a255a04b97c08d9ac5728d142f6c07

  • SHA256

    01e9404dc0e595e17433240104fc56ecd985d58b112791c738a9df6d5505e253

  • SHA512

    bec7a239cfc73896079d8f9ceca35ce34a38582d4426a5ca8c9f13138d2e7e918573f6700652afd7529816021147fa660b3b6af577114bc0bf198227ac850d18

  • SSDEEP

    3072:bVJVUmvyCoMhdFI7PYnPq4DZkiitlFukSYR6CML7Gs:h7Jvy67FIMP5D4rXYVKs

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WinZip_v10_Beta.exe
    "C:\Users\Admin\AppData\Local\Temp\WinZip_v10_Beta.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    PID:4360

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4360-0-0x0000000000402000-0x0000000000404000-memory.dmp

          Filesize

          8KB

        • memory/4360-1-0x0000000000A20000-0x0000000000A40000-memory.dmp

          Filesize

          128KB

        • memory/4360-2-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB