61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe
Size

1.0MB
MD5

1522adb30c620eed9a2462d291a405d8
SHA1

53fb119af6d5e8e9cacb90bff617e152258e6323
SHA256

61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284
SHA512

90609e5911881a98575424579d5769580ba254c116d617aebbf6ad7dc616e322ef8fa3e3d05954523aeadf99df7d54fcba35467db1d32991f395d5f07b115853
SSDEEP

24576:xJBQUgMKvEm3RAJvq8zXNghKYuKHQzsDDIZMyHty5B7eSdP:xJBXHjmW3j+DuSQYHIZLoQSdP

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe

description ioc process

File opened for modification \??\PhysicalDrive0 61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe

pid process

1376 61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe
1376 61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe

pid	process
1376	61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe
1376	61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe

C:\Users\Admin\AppData\Local\Temp\61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe
"C:\Users\Admin\AppData\Local\Temp\61eaa42cfc7599b5e23af803a29660165d2ea5902eb5fa851fc429dc86840284.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:8
1⤵
PID:3232

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-0-0x0000000000400000-0x00000000006AC0CF-memory.dmp

Filesize
2.7MB

Download
memory/1376-2-0x0000000000400000-0x00000000006AC0CF-memory.dmp

Filesize
2.7MB

Download
memory/1376-3-0x0000000000400000-0x00000000006AC0CF-memory.dmp

Filesize
2.7MB

Download
memory/1376-5-0x0000000000400000-0x00000000006AC0CF-memory.dmp

Filesize
2.7MB

Download