Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 07:22
Static task
static1
Behavioral task
behavioral1
Sample
cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe
Resource
win10v2004-20240508-en
General
-
Target
cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe
-
Size
9.8MB
-
MD5
f294a3dd7e844549ed1f410ed3ae8334
-
SHA1
9e4a04392447de70aef7e2824c77e1e2f8c865c5
-
SHA256
cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26
-
SHA512
19cce415d32847e201e61427bacb7e1d5382c0ddbdfdc697c71ba7ddaaf7d75b572c33601c92c0ea647e275e995770c6ad4dc38036ca57ab3399f55728ff288c
-
SSDEEP
196608:ij56FznjGSfNTk+k5Enjqd+O30kgOvecvdn:iCC54jsZkkg7cvdn
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exedescription ioc process File opened for modification \??\PhysicalDrive0 cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe -
Drops file in System32 directory 1 IoCs
Processes:
cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exedescription ioc process File opened for modification C:\Windows\SysWOW64\sysartzz.ini cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exepid process 1388 cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe 1388 cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe 1388 cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe"C:\Users\Admin\AppData\Local\Temp\cb68af1736d174afc57c344ad12bd5e62f4d4727ab70ce46ef6c9c6fe880af26.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1388-0-0x0000000000400000-0x0000000000E42000-memory.dmpFilesize
10.3MB