Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 01:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023gw1509-safety.exe
Resource
win10v2004-20240611-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023gw1509.exe
Resource
win10v2004-20240611-en
5 signatures
150 seconds
General
-
Target
2023gw1509.exe
-
Size
109KB
-
MD5
8ceee4d9fd1edbf2db49a0543565763f
-
SHA1
330f275b9bde64a7ae9fa2fd7515c511e2cb8351
-
SHA256
abc51f9202715b26d152c9c5f43fc18ff3e2304b0117930be6e2813d96f614e1
-
SHA512
15912cb177c47eebb2d4f591395991652dfde673f94e2df5a59e5b24ebc63d3036de5ae1628a90aae504be2160c20ec762c16047e4134e47a666951f5476b233
-
SSDEEP
1536:lN579bnA2KT3+DFLiDQNO0fiwx3oQTNZOM0EIwxrDD:17RnA22ONO0fiwx4QR8+t
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
2023gw1509.exedescription ioc process File opened for modification \??\PhysicalDrive0 2023gw1509.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 4568 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4568 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2023gw1509.execmd.exedescription pid process target process PID 2256 wrote to memory of 4716 2256 2023gw1509.exe cmd.exe PID 2256 wrote to memory of 4716 2256 2023gw1509.exe cmd.exe PID 2256 wrote to memory of 4716 2256 2023gw1509.exe cmd.exe PID 4716 wrote to memory of 3980 4716 cmd.exe reg.exe PID 4716 wrote to memory of 3980 4716 cmd.exe reg.exe PID 4716 wrote to memory of 3980 4716 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023gw1509.exe"C:\Users\Admin\AppData\Local\Temp\2023gw1509.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x2f41⤵
- Suspicious use of AdjustPrivilegeToken