Analysis

  • max time kernel
    15s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 21:19

General

  • Target

    Bootstrapper (1).exe

  • Size

    800KB

  • MD5

    2a4dcf20b82896be94eb538260c5fb93

  • SHA1

    21f232c2fd8132f8677e53258562ad98b455e679

  • SHA256

    ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a

  • SHA512

    4f1164b2312fb94b7030d6eb6aa9f3502912ffa33505f156443570fc964bfd3bb21ded3cf84092054e07346d2dce83a0907ba33f4ba39ad3fe7a78e836efe288

  • SSDEEP

    12288:t0zVvgDNMoWjTmFzAzBocaKjyWtiR1pptHxQ0z:O5vgHWjTwAlocaKjyyItHDz

Score
1/10

Malware Config

Signatures

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper (1).exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\system32\cmd.exe
      "cmd" /c ipconfig /all
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Windows\system32\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:604
    • C:\Windows\system32\cmd.exe
      "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3036
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2496 -s 1156
      2⤵
        PID:2936

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2496-0-0x000007FEF6133000-0x000007FEF6134000-memory.dmp

      Filesize

      4KB

    • memory/2496-1-0x0000000000950000-0x0000000000A1E000-memory.dmp

      Filesize

      824KB

    • memory/2496-2-0x000007FEF6130000-0x000007FEF6B1C000-memory.dmp

      Filesize

      9.9MB

    • memory/2496-3-0x000007FEF6133000-0x000007FEF6134000-memory.dmp

      Filesize

      4KB

    • memory/2496-4-0x000007FEF6130000-0x000007FEF6B1C000-memory.dmp

      Filesize

      9.9MB