Analysis
-
max time kernel
46s -
max time network
41s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-12-2024 17:14
Static task
static1
Behavioral task
behavioral1
Sample
Bootstraper.exe
Resource
win11-20241007-en
windows11-21h2-x64
9 signatures
1800 seconds
Behavioral task
behavioral2
Sample
cachehandler.dll
Resource
win11-20241023-en
windows11-21h2-x64
0 signatures
1800 seconds
General
-
Target
Bootstraper.exe
-
Size
71.0MB
-
MD5
e82c016015eb049019b94fd51ecd6e49
-
SHA1
bc230a8342944ddb28007baa2bd29cb07b29294e
-
SHA256
af5852b2f7312ac76fcd4ec798b8aacf7a5338b329664d2a79a6f31619230828
-
SHA512
4faa37bf5cebc40469379671e6fe88344fcc9df54ac99d7ec179f04aeaa5d805d0a935b43d79747542cfc329e1f1e78d95cbe6db9235f994cc0fdfbb6e156b98
-
SSDEEP
393216:Hqc1qcLg6WDV34gkpyfVEHqy2I6Sug+FIOMWg6SvbMK1UO9mBX2GWjNYi1M:Kc1qcLgtDV3fq235ghiSjMKny2GWBM
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2036 powershell.exe 72 powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
GoLang User-Agent 4 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 14 Go-http-client/1.1 HTTP User-Agent header 2 Go-http-client/1.1 HTTP User-Agent header 7 Go-http-client/1.1 HTTP User-Agent header 9 Go-http-client/1.1 -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Bootstraper.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Bootstraper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 Bootstraper.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 72 powershell.exe 72 powershell.exe 2036 powershell.exe 2036 powershell.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 72 powershell.exe Token: SeDebugPrivilege 2036 powershell.exe Token: SeIncreaseQuotaPrivilege 3360 wmic.exe Token: SeSecurityPrivilege 3360 wmic.exe Token: SeTakeOwnershipPrivilege 3360 wmic.exe Token: SeLoadDriverPrivilege 3360 wmic.exe Token: SeSystemProfilePrivilege 3360 wmic.exe Token: SeSystemtimePrivilege 3360 wmic.exe Token: SeProfSingleProcessPrivilege 3360 wmic.exe Token: SeIncBasePriorityPrivilege 3360 wmic.exe Token: SeCreatePagefilePrivilege 3360 wmic.exe Token: SeBackupPrivilege 3360 wmic.exe Token: SeRestorePrivilege 3360 wmic.exe Token: SeShutdownPrivilege 3360 wmic.exe Token: SeDebugPrivilege 3360 wmic.exe Token: SeSystemEnvironmentPrivilege 3360 wmic.exe Token: SeRemoteShutdownPrivilege 3360 wmic.exe Token: SeUndockPrivilege 3360 wmic.exe Token: SeManageVolumePrivilege 3360 wmic.exe Token: 33 3360 wmic.exe Token: 34 3360 wmic.exe Token: 35 3360 wmic.exe Token: 36 3360 wmic.exe Token: SeIncreaseQuotaPrivilege 3360 wmic.exe Token: SeSecurityPrivilege 3360 wmic.exe Token: SeTakeOwnershipPrivilege 3360 wmic.exe Token: SeLoadDriverPrivilege 3360 wmic.exe Token: SeSystemProfilePrivilege 3360 wmic.exe Token: SeSystemtimePrivilege 3360 wmic.exe Token: SeProfSingleProcessPrivilege 3360 wmic.exe Token: SeIncBasePriorityPrivilege 3360 wmic.exe Token: SeCreatePagefilePrivilege 3360 wmic.exe Token: SeBackupPrivilege 3360 wmic.exe Token: SeRestorePrivilege 3360 wmic.exe Token: SeShutdownPrivilege 3360 wmic.exe Token: SeDebugPrivilege 3360 wmic.exe Token: SeSystemEnvironmentPrivilege 3360 wmic.exe Token: SeRemoteShutdownPrivilege 3360 wmic.exe Token: SeUndockPrivilege 3360 wmic.exe Token: SeManageVolumePrivilege 3360 wmic.exe Token: 33 3360 wmic.exe Token: 34 3360 wmic.exe Token: 35 3360 wmic.exe Token: 36 3360 wmic.exe Token: SeDebugPrivilege 588 Taskmgr.exe Token: SeSystemProfilePrivilege 588 Taskmgr.exe Token: SeCreateGlobalPrivilege 588 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe -
Suspicious use of SendNotifyMessage 36 IoCs
pid Process 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe 588 Taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4416 wrote to memory of 72 4416 Bootstraper.exe 78 PID 4416 wrote to memory of 72 4416 Bootstraper.exe 78 PID 72 wrote to memory of 2036 72 powershell.exe 80 PID 72 wrote to memory of 2036 72 powershell.exe 80 PID 4416 wrote to memory of 3360 4416 Bootstraper.exe 81 PID 4416 wrote to memory of 3360 4416 Bootstraper.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstraper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstraper.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\Bootstraper.exe\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:72 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Bootstraper.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3360
-
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD5e3840d9bcedfe7017e49ee5d05bd1c46
SHA1272620fb2605bd196df471d62db4b2d280a363c6
SHA2563ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f
SHA51276adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82