Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 07:44
General
-
Target
css/goto.exe
-
Size
2.6MB
-
MD5
5d994ed0be59ab5f2f0242706b8b3b55
-
SHA1
b7787d1050691e9dbc5ef6dadc80c36761ae9697
-
SHA256
74533489c6609b07b00e578d98af29dd6250ddd800e5ecf5743cd9af2e2f24f3
-
SHA512
86c9e160b7b9015c790254857526aa554a020888383638eb4787a4f700b299cd16e26c08e4dac823be8832274eb3bc74421932e9bb880e44062053fc49f1de27
-
SSDEEP
49152:dJp9NvSqm1wFE5eBe0/4tmsHfK99IvS0mmvQDTGJt0P:AqsevwIN9Wn0
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\css\goto.exe"C:\Users\Admin\AppData\Local\Temp\css\goto.exe"1⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\css\goto.exe"C:\Users\Admin\AppData\Local\Temp\css\goto.exe" service1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\css\goto.exe"C:\Users\Admin\AppData\Local\Temp\css\goto.exe" Global\GotoHTTP_12⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD599ac68f1629e4dd627bd56fba97d3bc7
SHA175f51e2c35f970568bf1786eb773cc8581011d98
SHA2568029246632f7761611a50738e621ed2341390a3c7a18631b021a48aac65bc3d9
SHA512398121a44e5cc7105a302a068a69e60b86e7499ab49f828d5f8c07bdb0b2177cdf6f828224be691460bea0f2a419e16db6db3ee95e8758ce3fe9c0e85e52f0e2
-
Filesize
4KB
-
Filesize
4KB