Analysis

  • max time kernel
    141s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2024 07:56

General

  • Target

    37f7717758902951b507c7f5cfd5901e4d1fcd6e25218d1486e0a4cf7c1c4c42.exe

  • Size

    552KB

  • MD5

    e6c81f71d06d753dbce40f3f885bcc19

  • SHA1

    5bc5d599e56a09f1b92a34394067240c5a506797

  • SHA256

    37f7717758902951b507c7f5cfd5901e4d1fcd6e25218d1486e0a4cf7c1c4c42

  • SHA512

    3a8b7c7fd4aff92e7e81e0911e924e9df2569e36991216e578c05ce4b42f63176f0020119382646f0bf7df8dc5257086480c17aca8948ccee807d6a3cb5f8fe3

  • SSDEEP

    6144:AawN+H6sh6ybrVm44lnXOuGx+8749vFUdHl57wcGIGMrYt+5WbnJfA7KrypgTmoE:AsaI1mRnXOxp4SF1yy2+UyUytGOmTe

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\37f7717758902951b507c7f5cfd5901e4d1fcd6e25218d1486e0a4cf7c1c4c42.exe
    "C:\Users\Admin\AppData\Local\Temp\37f7717758902951b507c7f5cfd5901e4d1fcd6e25218d1486e0a4cf7c1c4c42.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    PID:3304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3304-1-0x0000000002D70000-0x0000000002E70000-memory.dmp

    Filesize

    1024KB

  • memory/3304-2-0x0000000004810000-0x000000000487B000-memory.dmp

    Filesize

    428KB

  • memory/3304-3-0x0000000000400000-0x000000000046F000-memory.dmp

    Filesize

    444KB

  • memory/3304-4-0x0000000000400000-0x0000000002B8D000-memory.dmp

    Filesize

    39.6MB

  • memory/3304-5-0x0000000002D70000-0x0000000002E70000-memory.dmp

    Filesize

    1024KB

  • memory/3304-7-0x0000000004810000-0x000000000487B000-memory.dmp

    Filesize

    428KB

  • memory/3304-6-0x0000000000400000-0x0000000002B8D000-memory.dmp

    Filesize

    39.6MB

  • memory/3304-8-0x0000000000400000-0x000000000046F000-memory.dmp

    Filesize

    444KB