Overview

overview

6

Static

static

3

4ffa3b051b...a5.exe

windows7-x64

6

4ffa3b051b...a5.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    103s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2025, 06:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4ffa3b051b4a3184307249485c29b1fd73965cbf6e7dfd020c76ba3e462011a5.exe

  • Size

    627KB

  • MD5

    0352bdde2c88720459d19ad829a6512b

  • SHA1

    41a3f90d76b4a455d0fb22bc262aea774ce8ad06

  • SHA256

    4ffa3b051b4a3184307249485c29b1fd73965cbf6e7dfd020c76ba3e462011a5

  • SHA512

    087313e46ac16bfb4bb220ec5eb3468c89a630b7ea93e355dac2ebaf5a9c322625b515dc43bc13b02236a1dbfce10ec36ff621dbd723df282d4a51b3f4b61c75

  • SSDEEP

    12288:55d3XhM6ThdQqWYgeWYg955/155/t+jBqUWOFapH/IFqSo5ME2:55dhZThdQIjBqhOFa9ggS62

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Windows directory 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ffa3b051b4a3184307249485c29b1fd73965cbf6e7dfd020c76ba3e462011a5.exe
    "C:\Users\Admin\AppData\Local\Temp\4ffa3b051b4a3184307249485c29b1fd73965cbf6e7dfd020c76ba3e462011a5.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Writes to the Master Boot Record (MBR)
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\system32lri.dat
    Filesize

    8B

    MD5

    465a6203ae009d496370d5bccf92d5dc

    SHA1

    7d6f8404c6a0076a7cbe1753e8825425330fd8bc

    SHA256

    d2a7fd9e2bf5230d829803b6b0bb6549bcb7e3e75a5f85281e5197761dd7e6c2

    SHA512

    47c3e31569d6b06418499d3750df299f8d94dffb4d3137448186840d001dfd89d0954a78df5dea8d0adbd0262ca4f5c78bae7b0371cdc0f7127fca0dbec12601

    Download Submit

  • C:\Windows\system32lrk.dat
    Filesize

    32B

    MD5

    e59211b7376e30db8605f7e0ae8a7cfb

    SHA1

    c00f0653e643186aad72861b032ef80d1214be0b

    SHA256

    9cdc01b84885ccb3ea3d22da9d1b2250caf7b93135a07fcce2c5d6658d79df1d

    SHA512

    26fb9af580f372fe44f9ccee741530602a1317a657114dc8ceaee4a9e30487142660357c0afa93367b92940c140f0d4bf795ba2e76c3073616636047b7f94098

    Download Submit