Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 07:42
Static task
static1
Behavioral task
behavioral1
Sample
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe
Resource
win10v2004-20220414-en
General
-
Target
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe
-
Size
956KB
-
MD5
7ee33bc8844bfffa8b67707fe43e28d5
-
SHA1
d26454279d716475900b8f50d1bd46ec7e6971cc
-
SHA256
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb
-
SHA512
2ad11b1c268c51431ee9bfdf41addfcaf6b1aa3693eb51ba295d824382b4ab74c5fc806045d5ee96ee01ddd1694934523ca20c5ec42e802be11711c7d2c0ee53
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/5012-130-0x0000000010000000-0x000000001000B000-memory.dmp upx behavioral2/memory/5012-131-0x0000000010000000-0x000000001000B000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exedescription ioc process File opened for modification \??\PhysicalDrive0 e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4888 5012 WerFault.exe e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe"C:\Users\Admin\AppData\Local\Temp\e0d8ee610cffcc4a30e3d6a3c443ce3e2445fac944a8ecad22deb253abf76ccb.exe"1⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5012 -ip 50121⤵