616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2

Analysis

Target

616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe
Size

956KB
MD5

d6e0738dd82aad7e9a69c82d90222c99
SHA1

f95d5104308894c9e687a1bc19f2f4306493afdd
SHA256

616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2
SHA512

734e286fe3fa419d45d5fdbc10d80eebaf9c80fdfefe5b917eb5f162ef3551b7b0ec4702fef86505845fec3af4adae2da57cd9c3ec208532a323cbdb885586da

Score

8^/10

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1956-130-0x0000000010000000-0x000000001000B000-memory.dmp	upx
behavioral2/memory/1956-131-0x0000000010000000-0x000000001000B000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe

description ioc process

File opened for modification \??\PhysicalDrive0 616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3492 1956 WerFault.exe 616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe

pid	pid_target	process	target process
3492	1956	WerFault.exe	616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe

C:\Users\Admin\AppData\Local\Temp\616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe
"C:\Users\Admin\AppData\Local\Temp\616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 584
  2⤵
  - Program crash
  PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1956 -ip 1956
1⤵
PID:4152

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1956-130-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/1956-131-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download