Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 03:32
Behavioral task
behavioral1
Sample
LEX2.dll
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
LEX2.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
LEX2.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
LEX2.exe
Resource
win10v2004-20250314-en
General
-
Target
LEX2.exe
-
Size
196KB
-
MD5
25f8e47eeb9294021b5b73ca301020c0
-
SHA1
2072e2827682c30b4781b7b35a07fbc35f69f3ad
-
SHA256
99afe0c5ca3d147c492001ac34a1bea8fb44134abcfe4c7228c2e1cf11a59afa
-
SHA512
ac98896b6f0de6d4c3f25d311aae3467a6da9bffe7c5834a83292534bd8df87f28e7166ad580986721322aa59313c0bfeea8cad863d60a7c727181bf0fca554b
-
SSDEEP
6144:wihCgS506gI98gWNlPTGQQm6agrdmbF6LF8frGz5o:wDO6oNtTirdsdjso
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 LEX2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe 2112 LEX2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 2112 LEX2.exe Token: SeDebugPrivilege 2112 LEX2.exe