Find similar analyses in TI Lookup

Analysis date (UTC): 27 March 2021, 10:39Analysis environment: Windows 7 Pro, build 7601, x86

Mbr Owerwrite.zip

MD5:95D238DA651401A19CC55D9864A9A27B

SHA1:6E5FD47EC95A3C66552CB234FCFC8552BAE908A6

SHA256:C25594D76A8034F7227A7B4497870FBB26166A78F507B378802719C07E473C79

Analysis result

Threat level:Malicious activity

Full analysis:Analysis Mbr Owerwrite.zip (MD5: 95D238DA651401A19CC55D9864A9A27B) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

MBR - Image Builder.exe (PID: 3052)
MBR - Note Builder.exe (PID: 3900)
1.exe (PID: 1892)
1.exe (PID: 2996)
MBR - Image Builder.exe (PID: 1144)

Low-level write access rights to disk partition

1.exe (PID: 2996)

SUSPICIOUS

Drops a file with too old compile date

WinRAR.exe (PID: 3072)
MBR - Note Builder.exe (PID: 3900)

Executable content was dropped or overwritten

WinRAR.exe (PID: 3072)
MBR - Note Builder.exe (PID: 3900)

Application launched itself

1.exe (PID: 1892)

Low-level read access rights to disk partition

1.exe (PID: 2996)

INFO

Manual execution by user

MBR - Image Builder.exe (PID: 3052)
MBR - Note Builder.exe (PID: 3900)
WINWORD.EXE (PID: 280)
1.exe (PID: 1892)
cmd.exe (PID: 2652)
MBR - Image Builder.exe (PID: 1144)

Creates files in the user directory

WINWORD.EXE (PID: 280)

Reads Microsoft Office registry keys

WINWORD.EXE (PID: 280)

Threats

No threats detected