461d83b68c5b7afb97eb2a9f21c4622b7b5250a3cd6bab01bde492349f9ecb46

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DSWIN.bat
Size

23B
MD5

a07cec4db198a3c6116451c44f0380a9
SHA1

513e3f7454296dc6a41864835582c21ff1d931aa
SHA256

98286d0be9363406f2d9cc903265b10601f1332fc800e7a5de578b39bee5d29d
SHA512

e69eb4059212636755206b9e6de488bace276a2af51af147ff3b57bfbe129eac82c68da7a70a827cf256693d7f9c5892a4ad3850dbc09c0f0d11ebf70c82aec0

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DSWIN.EXE

description	ioc	process
File opened (read-only)	\??\W:	DSWIN.EXE
File opened (read-only)	\??\F:	DSWIN.EXE
File opened (read-only)	\??\G:	DSWIN.EXE
File opened (read-only)	\??\H:	DSWIN.EXE
File opened (read-only)	\??\M:	DSWIN.EXE
File opened (read-only)	\??\O:	DSWIN.EXE
File opened (read-only)	\??\V:	DSWIN.EXE
File opened (read-only)	\??\N:	DSWIN.EXE
File opened (read-only)	\??\R:	DSWIN.EXE
File opened (read-only)	\??\X:	DSWIN.EXE
File opened (read-only)	\??\J:	DSWIN.EXE
File opened (read-only)	\??\P:	DSWIN.EXE
File opened (read-only)	\??\S:	DSWIN.EXE
File opened (read-only)	\??\U:	DSWIN.EXE
File opened (read-only)	\??\E:	DSWIN.EXE
File opened (read-only)	\??\I:	DSWIN.EXE
File opened (read-only)	\??\K:	DSWIN.EXE
File opened (read-only)	\??\L:	DSWIN.EXE
File opened (read-only)	\??\Q:	DSWIN.EXE
File opened (read-only)	\??\T:	DSWIN.EXE

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

DSWIN.EXE

description ioc process

File opened for modification \??\PHYSICALDRIVE0 DSWIN.EXE

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	DSWIN.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 452 wrote to memory of 844	452	cmd.exe	DSWIN.EXE
PID 452 wrote to memory of 844	452	cmd.exe	DSWIN.EXE
PID 452 wrote to memory of 844	452	cmd.exe	DSWIN.EXE

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DSWIN.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:452

C:\Users\Admin\AppData\Local\Temp\DSWIN.EXE
dswin.exe
2⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-130-0x0000000000000000-mapping.dmp

Download