Analysis
-
max time kernel
91s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 13:54
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20241007-en
General
-
Target
Bootstrapper.exe
-
Size
800KB
-
MD5
02c70d9d6696950c198db93b7f6a835e
-
SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2
-
SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
-
SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
-
SSDEEP
12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Bootstrapper.exe -
Executes dropped EXE 1 IoCs
pid Process 1200 BootstrapperV2.04.exe -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1144 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3384 WMIC.exe Token: SeSecurityPrivilege 3384 WMIC.exe Token: SeTakeOwnershipPrivilege 3384 WMIC.exe Token: SeLoadDriverPrivilege 3384 WMIC.exe Token: SeSystemProfilePrivilege 3384 WMIC.exe Token: SeSystemtimePrivilege 3384 WMIC.exe Token: SeProfSingleProcessPrivilege 3384 WMIC.exe Token: SeIncBasePriorityPrivilege 3384 WMIC.exe Token: SeCreatePagefilePrivilege 3384 WMIC.exe Token: SeBackupPrivilege 3384 WMIC.exe Token: SeRestorePrivilege 3384 WMIC.exe Token: SeShutdownPrivilege 3384 WMIC.exe Token: SeDebugPrivilege 3384 WMIC.exe Token: SeSystemEnvironmentPrivilege 3384 WMIC.exe Token: SeRemoteShutdownPrivilege 3384 WMIC.exe Token: SeUndockPrivilege 3384 WMIC.exe Token: SeManageVolumePrivilege 3384 WMIC.exe Token: 33 3384 WMIC.exe Token: 34 3384 WMIC.exe Token: 35 3384 WMIC.exe Token: 36 3384 WMIC.exe Token: SeIncreaseQuotaPrivilege 3384 WMIC.exe Token: SeSecurityPrivilege 3384 WMIC.exe Token: SeTakeOwnershipPrivilege 3384 WMIC.exe Token: SeLoadDriverPrivilege 3384 WMIC.exe Token: SeSystemProfilePrivilege 3384 WMIC.exe Token: SeSystemtimePrivilege 3384 WMIC.exe Token: SeProfSingleProcessPrivilege 3384 WMIC.exe Token: SeIncBasePriorityPrivilege 3384 WMIC.exe Token: SeCreatePagefilePrivilege 3384 WMIC.exe Token: SeBackupPrivilege 3384 WMIC.exe Token: SeRestorePrivilege 3384 WMIC.exe Token: SeShutdownPrivilege 3384 WMIC.exe Token: SeDebugPrivilege 3384 WMIC.exe Token: SeSystemEnvironmentPrivilege 3384 WMIC.exe Token: SeRemoteShutdownPrivilege 3384 WMIC.exe Token: SeUndockPrivilege 3384 WMIC.exe Token: SeManageVolumePrivilege 3384 WMIC.exe Token: 33 3384 WMIC.exe Token: 34 3384 WMIC.exe Token: 35 3384 WMIC.exe Token: 36 3384 WMIC.exe Token: SeDebugPrivilege 1804 Bootstrapper.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1804 wrote to memory of 4856 1804 Bootstrapper.exe 83 PID 1804 wrote to memory of 4856 1804 Bootstrapper.exe 83 PID 4856 wrote to memory of 1144 4856 cmd.exe 85 PID 4856 wrote to memory of 1144 4856 cmd.exe 85 PID 1804 wrote to memory of 2780 1804 Bootstrapper.exe 86 PID 1804 wrote to memory of 2780 1804 Bootstrapper.exe 86 PID 2780 wrote to memory of 3384 2780 cmd.exe 88 PID 2780 wrote to memory of 3384 2780 cmd.exe 88 PID 1804 wrote to memory of 1200 1804 Bootstrapper.exe 93 PID 1804 wrote to memory of 1200 1804 Bootstrapper.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1144
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")2⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\System32\Wbem\WMIC.exewmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe" --isUpdate true2⤵
- Executes dropped EXE
PID:1200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5be4da425d9b7593e358ffbfca29f9c70
SHA1dc98530aad9728d779866ae957a738c52b13a565
SHA256c5277ddb6e51181d2b8bad59acf5f2badf5613b1e73384a84b793f720aa76c0d
SHA51235790944f5855038f8357c0f6d11ea81b260632e590c26f9342e8beb1a8dfd2e3eb9efa11f8378f8542cad45e7675af3d29cf27424accf35aaa6aeb34487155b