Overview

overview

6

Static

static

c052f14f3b...d7.exe

windows7_x64

6

c052f14f3b...d7.exe

windows10-2004_x64

6

Analysis

  • max time kernel
    159s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 18:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c052f14f3b6a2aa2ddac02eaaf8afd22e1e19a94725509b28e87f5ee39bc2ed7.exe

  • Size

    837KB

  • MD5

    634b173fe43d25859263331dbe25c459

  • SHA1

    6092e7be079a9b78a04291c1c5aff02e89d1ae51

  • SHA256

    c052f14f3b6a2aa2ddac02eaaf8afd22e1e19a94725509b28e87f5ee39bc2ed7

  • SHA512

    0774be4714c422cc545851f6a70c07b789fc1b8e05a0164235f84c125deca71a558212cf64a26f7d323f80afd8d18f261010e998d9b46f85fc8e9e036d9b57bd

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c052f14f3b6a2aa2ddac02eaaf8afd22e1e19a94725509b28e87f5ee39bc2ed7.exe
    "C:\Users\Admin\AppData\Local\Temp\c052f14f3b6a2aa2ddac02eaaf8afd22e1e19a94725509b28e87f5ee39bc2ed7.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    PID:4124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4124-131-0x0000000003530000-0x0000000003534000-memory.dmp
    Filesize

    16KB

    Download
  • memory/4124-130-0x0000000002380000-0x00000000023D4000-memory.dmp
    Filesize

    336KB

    Download
  • memory/4124-132-0x0000000003520000-0x0000000003524000-memory.dmp
    Filesize

    16KB

    Download