Analysis

  • max time kernel
    93s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 20:43

General

  • Target

    bb7d99844b3b116d8fda1333dacc9089f41f761ff9df4907bb13eb1c0f959f3a.exe

  • Size

    4.5MB

  • MD5

    a21ed58c0def06ab578b206a1a06443b

  • SHA1

    a109d00b850d23a7857f97b118165c1efc961e76

  • SHA256

    bb7d99844b3b116d8fda1333dacc9089f41f761ff9df4907bb13eb1c0f959f3a

  • SHA512

    99c6ad00469e322dfc7b9a4fb050dcb40d913a5ca5535d708ab90c5cfdb136e150f7a128bc9648c15b6fa63a33eda603185c032deabba0c53aee71835099fbb2

  • SSDEEP

    98304:R5rVJK49wvMIcfRwa/yljpWRcohJBAUZLwWFh:Hrnt9ZRwljW5hJVXh

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb7d99844b3b116d8fda1333dacc9089f41f761ff9df4907bb13eb1c0f959f3a.exe
    "C:\Users\Admin\AppData\Local\Temp\bb7d99844b3b116d8fda1333dacc9089f41f761ff9df4907bb13eb1c0f959f3a.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ipconfig/all
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /all
        3⤵
        • System Location Discovery: System Language Discovery
        • Gathers network information
        PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads