8c648bd94a5a6fa9f06f6b3c4853d0b876298096a6dbb2073f9ec7f966a23813

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Marijuana.exe
Size 522KB
Sample260906-znvwksseqg
SHA256 8c648bd94a5a6fa9f06f6b3c4853d0b876298096a6dbb2073f9ec7f966a23813
MD5 af831cf6653bbb61c890ddf11c8bbb76
SHA1 224deaf6bdf74ca450972eeb6038d084cb9d4e63
SHA512 ef00cb29cffeb649aa4a6feb3903cc4a9cfb569bb0a6c52751f6dcccbd8f30ab02c6ac6e897a2db2d11ce727ba19a6df3768e5b8ec454d26657aa58706202b64
SSDEEP 12288:hS4Mql2YwA4DEasC7Kq9nRpljl7qYZFar:hSNI544azjlRpfG
TLSH
T117B4BF96BDC6CC92CA222A3089B1E1F1993EBE21DD15851777883F5DFF30D995C20BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Marijuana.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 1 IoCs

pid	Process
4500	mbr.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Marijuana.exe
File opened for modification	\??\PhysicalDrive0	mbr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3388	cmd.exe
4180	cmd.exe
992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	Marijuana.exe
Token: SeDebugPrivilege	4416	Marijuana.exe
Token: 33	1920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1920	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 992	4416	Marijuana.exe	90
PID 4416 wrote to memory of 4180	4416	Marijuana.exe	91
PID 4416 wrote to memory of 3388	4416	Marijuana.exe	92
PID 4180 wrote to memory of 6036	4180	cmd.exe	96
PID 3388 wrote to memory of 5740	3388	cmd.exe	97
PID 992 wrote to memory of 2856	992	cmd.exe	98
PID 4416 wrote to memory of 4500	4416	Marijuana.exe	99

C:\Users\Admin\AppData\Local\Temp\Marijuana.exe
"C:\Users\Admin\AppData\Local\Temp\Marijuana.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C reg delete HKCR /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\system32\reg.exe
    reg delete HKCR /f
    3⤵
    PID:2856
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C reg delete HKU /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\system32\reg.exe
    reg delete HKU /f
    3⤵
    PID:6036
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C reg delete HKCC /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\system32\reg.exe
    reg delete HKCC /f
    3⤵
    PID:5740
- C:\Users\Admin\AppData\Local\Temp\mbr.exe
  "C:\Users\Admin\AppData\Local\Temp\mbr.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:4500

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mbr.exe

Path C:\Users\Admin\AppData\Local\Temp\mbr.exe
Size 93KB
SHA256 bc6f0280660a7f2434bad3621f9b50ba9d214458b5bccbd6a69dd93988407dff
MD5 245093ef4cfa3c0dccbefa4acbbe6bff
SHA1 c1fae1ef19a1fc9868f5dd2ae9967240076c45ae
SHA512 4affe79442799d093050c001fab37a95418590c5fcdda912e2bc0f7176d4e8d48bd9d2831c46d03e2d13edc66d34e2d1b7855d27d3a399744293f1929106d191
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oNxO6:Tv5MYRIMPqiTJx+ZqreRQ5/hXoj
TLSH
T1BA936C43B5D28CB2E5721D3148B1C9A19A6FB9210F648E6B6798137D1F340D0AE39FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6D43.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6D43.tmp
Size 368KB
SHA256 ddca856fbcd1c7fc94c8a297e035f6e2ef2ba7b1cce31e078a149bd8c0760696
MD5 1d250bc56a63fe4fb3f9733b50126ad0
SHA1 595912acf4f530bc4696c2cc47e6bd4454df56c5
SHA512 e1b6cecbb7fd49467fad2a0aca2368407e05220358c701d6c3af1500d0ae248a49f66c55b38297d5cc3f4a40bbc2b348d0d4854bcf9e9ade2d9883615bd0af9c
SSDEEP 6144:5jKjD5AXSysY/ZmvnLo6Ihg6gr4CYtng9SQ6oXe1952K9K/VOBh3O8JfiQt:th9dgGma9K/eh3dfxt
TLSH
T104842B873EA5D61BCB4307744DA32342B33DE4C4879DDB078E50A4318E9A71F99E9AC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4416-13-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-6-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-7-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-5-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-1-0x00007FFF2469F000-0x00007FFF246A0000-memory.dmp

Download

memory/4416-19-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-17-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-20-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-14-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-21-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-22-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-23-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp

Download

memory/4416-0-0x000002CE399C0000-0x000002CE39A48000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads