Overview

overview

10

Static

static

3

bomb.exe

windows7-x64

bomb.exe

windows10-2004-x64

bomb.exe

windows10-ltsc 2021-x64

bomb.exe

windows11-21h2-x64

10

Resubmissions

22/02/2025, 17:20

250222-vwwqmavlhl 10

22/02/2025, 16:34

250222-t3a7tstphq 10

Analysis

  • max time kernel
    94s
  • max time network
    97s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2025, 16:34

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    bomb.exe

  • Size

    12KB

  • MD5

    a14e63d27e1ac1df185fa062103aa9aa

  • SHA1

    2b64c35e4eff4a43ab6928979b6093b95f9fd714

  • SHA256

    dda39f19837168845de33959de34bcfb7ee7f3a29ae55c9fa7f4cb12cb27f453

  • SHA512

    10418efcce2970dcdbef1950464c4001753fccb436f4e8ba5f08f0d4d5c9b4a22a48f2803e59421b720393d84cfabd338497c0bc77cdd4548990930b9c350082

  • SSDEEP

    192:brl2reIazGejA7HhdSbw/z1ULU87glpK/b26J4S1Xu85:b52r+xjALhMWULU870gJJ

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bomb.exe
    "C:\Users\Admin\AppData\Local\Temp\bomb.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2336
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2596
    • C:\Users\Admin\AppData\Local\Temp\bomb.exe
      "C:\Users\Admin\AppData\Local\Temp\bomb.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2768
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0
      1⤵
        PID:1748
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x1
        1⤵
          PID:736

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1
          Filesize

          867B

          MD5

          c5dfb849ca051355ee2dba1ac33eb028

          SHA1

          d69b561148f01c77c54578c10926df5b856976ad

          SHA256

          cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

          SHA512

          88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          2ea5afaab3a37e042f21ca7d4c2f9791

          SHA1

          8bd56396aaa58268f684811151e75a2990962615

          SHA256

          5f0c5d4ca412fd781286c79e88ace705c6beac6a26868b1fc82d1305aa847d6e

          SHA512

          1a2029bccc5b96ec52b49b7ec21fb0fd8a15563b64f8f64e59f21cba495042de43b0bf39e5d448c916f600f5de328c976593ec0b048c6fce2242250a8b685cd1

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
          Filesize

          242B

          MD5

          89b5dc2debead3e369ae10f444798f15

          SHA1

          60ffcca000951b54eb88fb1aae7817d9cdda0c66

          SHA256

          fb6b6900f1695198f06a0b1e636d19cfc02773504d5f31bd3957bdebd9907638

          SHA512

          3d62c64d22154085c6c17a484faf43957eee9ef673164137920e0cfcd25e9f293def581efde5d23cec00416a721240a7062379a489a1e67e3264a53afeee1031

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\CabDAF6.tmp
          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TarDB18.tmp
          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          Download Submit

        • memory/2336-0-0x000007FEF5993000-0x000007FEF5994000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2336-1-0x00000000008D0000-0x00000000008DA000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2336-2-0x000007FEF5993000-0x000007FEF5994000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2336-3-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2336-58-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2336-59-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

          Filesize

          9.9MB

          Download

        • memory/2768-60-0x00000000013E0000-0x00000000013EA000-memory.dmp

          Filesize

          40KB

          Download