Analysis
-
max time kernel
94s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 18:26
Static task
static1
Behavioral task
behavioral1
Sample
6ea2741457b2ffd7d0628ca51ad4a0bf054d69ef9970bc8d1b1ef2c4e5fe940f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6ea2741457b2ffd7d0628ca51ad4a0bf054d69ef9970bc8d1b1ef2c4e5fe940f.exe
Resource
win10v2004-20220414-en
General
-
Target
6ea2741457b2ffd7d0628ca51ad4a0bf054d69ef9970bc8d1b1ef2c4e5fe940f.exe
-
Size
956KB
-
MD5
aee31b543b133f2fa2d08213e92b1610
-
SHA1
05e9b5e2c191fbda04047eee96a7cd254f7566ae
-
SHA256
6ea2741457b2ffd7d0628ca51ad4a0bf054d69ef9970bc8d1b1ef2c4e5fe940f
-
SHA512
9a80740958f610724d69a7413d7a0b23791acf5472c23e7577cdadb452736e2ae724130c1cd5c28055c7b19933ef1d0857c09d4cba4cba87bac20ed9f9508a45
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/980-130-0x0000000010000000-0x000000001000B000-memory.dmp upx behavioral2/memory/980-131-0x0000000010000000-0x000000001000B000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
6ea2741457b2ffd7d0628ca51ad4a0bf054d69ef9970bc8d1b1ef2c4e5fe940f.exedescription ioc process File opened for modification \??\PhysicalDrive0 6ea2741457b2ffd7d0628ca51ad4a0bf054d69ef9970bc8d1b1ef2c4e5fe940f.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 888 980 WerFault.exe 6ea2741457b2ffd7d0628ca51ad4a0bf054d69ef9970bc8d1b1ef2c4e5fe940f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ea2741457b2ffd7d0628ca51ad4a0bf054d69ef9970bc8d1b1ef2c4e5fe940f.exe"C:\Users\Admin\AppData\Local\Temp\6ea2741457b2ffd7d0628ca51ad4a0bf054d69ef9970bc8d1b1ef2c4e5fe940f.exe"1⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 5722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 980 -ip 9801⤵