Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2025, 03:32

General

  • Target

    LEX2.exe

  • Size

    196KB

  • MD5

    25f8e47eeb9294021b5b73ca301020c0

  • SHA1

    2072e2827682c30b4781b7b35a07fbc35f69f3ad

  • SHA256

    99afe0c5ca3d147c492001ac34a1bea8fb44134abcfe4c7228c2e1cf11a59afa

  • SHA512

    ac98896b6f0de6d4c3f25d311aae3467a6da9bffe7c5834a83292534bd8df87f28e7166ad580986721322aa59313c0bfeea8cad863d60a7c727181bf0fca554b

  • SSDEEP

    6144:wihCgS506gI98gWNlPTGQQm6agrdmbF6LF8frGz5o:wDO6oNtTirdsdjso

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LEX2.exe
    "C:\Users\Admin\AppData\Local\Temp\LEX2.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2112-0-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2112-1-0x0000000000320000-0x0000000000363000-memory.dmp

    Filesize

    268KB

  • memory/2112-8-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2112-7-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2112-6-0x0000000000370000-0x0000000000371000-memory.dmp

    Filesize

    4KB

  • memory/2112-5-0x0000000000380000-0x0000000000381000-memory.dmp

    Filesize

    4KB

  • memory/2112-4-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2112-3-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2112-2-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2112-9-0x0000000000390000-0x0000000000391000-memory.dmp

    Filesize

    4KB

  • memory/2112-11-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2112-12-0x0000000000460000-0x0000000000463000-memory.dmp

    Filesize

    12KB

  • memory/2112-10-0x0000000000300000-0x0000000000301000-memory.dmp

    Filesize

    4KB

  • memory/2112-13-0x0000000000450000-0x0000000000457000-memory.dmp

    Filesize

    28KB

  • memory/2112-16-0x0000000000470000-0x0000000000471000-memory.dmp

    Filesize

    4KB

  • memory/2112-17-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2112-15-0x00000000004C0000-0x00000000004C1000-memory.dmp

    Filesize

    4KB

  • memory/2112-14-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/2112-19-0x0000000001D00000-0x0000000001D01000-memory.dmp

    Filesize

    4KB

  • memory/2112-18-0x0000000000480000-0x0000000000481000-memory.dmp

    Filesize

    4KB

  • memory/2112-20-0x00000000004D0000-0x00000000004D1000-memory.dmp

    Filesize

    4KB

  • memory/2112-42-0x0000000001D60000-0x0000000001D61000-memory.dmp

    Filesize

    4KB

  • memory/2112-53-0x0000000002420000-0x0000000002421000-memory.dmp

    Filesize

    4KB

  • memory/2112-52-0x0000000002400000-0x0000000002401000-memory.dmp

    Filesize

    4KB

  • memory/2112-51-0x00000000023E0000-0x00000000023E1000-memory.dmp

    Filesize

    4KB

  • memory/2112-63-0x00000000025E0000-0x00000000025E1000-memory.dmp

    Filesize

    4KB

  • memory/2112-68-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/2112-67-0x0000000002620000-0x0000000002621000-memory.dmp

    Filesize

    4KB

  • memory/2112-66-0x0000000002630000-0x0000000002631000-memory.dmp

    Filesize

    4KB

  • memory/2112-65-0x0000000002610000-0x0000000002611000-memory.dmp

    Filesize

    4KB

  • memory/2112-64-0x0000000002600000-0x0000000002601000-memory.dmp

    Filesize

    4KB

  • memory/2112-62-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/2112-61-0x00000000025F0000-0x00000000025F1000-memory.dmp

    Filesize

    4KB

  • memory/2112-60-0x00000000025D0000-0x00000000025D1000-memory.dmp

    Filesize

    4KB

  • memory/2112-59-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/2112-58-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/2112-57-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB

  • memory/2112-56-0x0000000002570000-0x0000000002571000-memory.dmp

    Filesize

    4KB

  • memory/2112-54-0x0000000002580000-0x0000000002581000-memory.dmp

    Filesize

    4KB

  • memory/2112-50-0x00000000023C0000-0x00000000023C1000-memory.dmp

    Filesize

    4KB

  • memory/2112-49-0x0000000002090000-0x0000000002091000-memory.dmp

    Filesize

    4KB

  • memory/2112-48-0x0000000002040000-0x0000000002041000-memory.dmp

    Filesize

    4KB

  • memory/2112-47-0x0000000002020000-0x0000000002021000-memory.dmp

    Filesize

    4KB

  • memory/2112-46-0x0000000002000000-0x0000000002001000-memory.dmp

    Filesize

    4KB

  • memory/2112-45-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

    Filesize

    4KB

  • memory/2112-44-0x0000000001D80000-0x0000000001D81000-memory.dmp

    Filesize

    4KB

  • memory/2112-43-0x0000000000320000-0x0000000000363000-memory.dmp

    Filesize

    268KB

  • memory/2112-41-0x0000000001D40000-0x0000000001D41000-memory.dmp

    Filesize

    4KB

  • memory/2112-40-0x0000000001D20000-0x0000000001D21000-memory.dmp

    Filesize

    4KB

  • memory/2112-39-0x0000000000440000-0x0000000000441000-memory.dmp

    Filesize

    4KB

  • memory/2112-38-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2112-37-0x0000000002410000-0x0000000002411000-memory.dmp

    Filesize

    4KB

  • memory/2112-36-0x00000000023F0000-0x00000000023F1000-memory.dmp

    Filesize

    4KB

  • memory/2112-35-0x00000000023D0000-0x00000000023D1000-memory.dmp

    Filesize

    4KB

  • memory/2112-34-0x00000000023B0000-0x00000000023B1000-memory.dmp

    Filesize

    4KB

  • memory/2112-33-0x0000000002080000-0x0000000002081000-memory.dmp

    Filesize

    4KB

  • memory/2112-32-0x0000000002050000-0x0000000002051000-memory.dmp

    Filesize

    4KB

  • memory/2112-31-0x0000000002070000-0x0000000002071000-memory.dmp

    Filesize

    4KB

  • memory/2112-30-0x0000000002030000-0x0000000002031000-memory.dmp

    Filesize

    4KB

  • memory/2112-29-0x0000000002010000-0x0000000002011000-memory.dmp

    Filesize

    4KB

  • memory/2112-28-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

    Filesize

    4KB

  • memory/2112-27-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

    Filesize

    4KB

  • memory/2112-26-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

    Filesize

    4KB

  • memory/2112-25-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

    Filesize

    4KB

  • memory/2112-24-0x0000000001D70000-0x0000000001D71000-memory.dmp

    Filesize

    4KB

  • memory/2112-23-0x0000000001D50000-0x0000000001D51000-memory.dmp

    Filesize

    4KB

  • memory/2112-22-0x0000000001D30000-0x0000000001D31000-memory.dmp

    Filesize

    4KB

  • memory/2112-21-0x0000000001D10000-0x0000000001D11000-memory.dmp

    Filesize

    4KB

  • memory/2112-69-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2112-70-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2112-71-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2112-72-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2112-74-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB