Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
30-06-2024 19:45
General
-
Target
26c5fa67948d34287f3da17fb83b50eb8c3fdd725b3b631ba721fa642a9b7cd3.exe
-
Size
1.3MB
-
MD5
0b4d64e655a9eeeb3d1a901b9f97a8f1
-
SHA1
3878ebeed319110a2e4b84018c9b1692a990a6e4
-
SHA256
26c5fa67948d34287f3da17fb83b50eb8c3fdd725b3b631ba721fa642a9b7cd3
-
SHA512
e58b69b8da4e4ce7955f328551ed3f3b59d2388b32b885296dde63c6a4aac96fce2780dcdadd7017f8a5afab6749b272283c934101e1e617fdba21c56d8c0afa
-
SSDEEP
24576:xo5ik3NNyIOkkVEv6KusCmpvmmxDBWq8muFVquk5QhLeS7oLq8LXAU0Q:xokabPgVwkDKQESOJt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26c5fa67948d34287f3da17fb83b50eb8c3fdd725b3b631ba721fa642a9b7cd3.exe"C:\Users\Admin\AppData\Local\Temp\26c5fa67948d34287f3da17fb83b50eb8c3fdd725b3b631ba721fa642a9b7cd3.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JK14_testVC2008.exeC:\Users\Admin\AppData\Local\Temp\JK14_testVC2008.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\httpErrorPagesScripts[1]Filesize
8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\NewErrorPageTemplate[1]Filesize
1KB
MD5cdf81e591d9cbfb47a7f97a2bcdb70b9
SHA18f12010dfaacdecad77b70a3e781c707cf328496
SHA256204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd
SHA512977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\errorPageStrings[1]Filesize
2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\dnserrordiagoff[1]Filesize
1KB
MD547f581b112d58eda23ea8b2e08cf0ff0
SHA16ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92
-
C:\Users\Admin\AppData\Local\Temp\JK14_testVC2008.exeFilesize
7KB
MD55593cd5b5870147cc467fe6bab0e17fa
SHA1f035e247ecba66d39c0971338534de762c90b7ae
SHA25675f68c1db6e21038372860a88154528c1916b9a38fde5fb1dab2eea8247ecc06
SHA512f3e4f948d482cb520bed6e69065957a2e1007804cbffd63195dc5e35ff68908cc834891224d7dc8e9ebc2ba0dd72b3c553abe76cc797d4530cd1284d2202211c
-
C:\Users\Admin\AppData\Local\Temp\jk14_cso_loader.iniFilesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
memory/1868-0-0x0000000000400000-0x0000000000751000-memory.dmpFilesize
3.3MB
-
memory/1868-1-0x0000000000400000-0x0000000000751000-memory.dmpFilesize
3.3MB
-
memory/1868-13-0x00000000057D0000-0x0000000005BE2000-memory.dmpFilesize
4.1MB
-
memory/1868-69-0x00000000091A0000-0x00000000091A2000-memory.dmpFilesize
8KB
-
memory/1868-86-0x0000000000400000-0x0000000000751000-memory.dmpFilesize
3.3MB