5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
01-08-2022 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe
Size

779KB
MD5

f65fbe59c0259ddb797b16748db3fc51
SHA1

0ff7ba38c69e4e9766fc0d2d920bb5fc33d5ec95
SHA256

5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312
SHA512

3275e12ccfe275166d8750d5f852f2d6044bffe936f12fc4057e842f9d28918b48b5a53c31a1694adf4e727b4bae709ed638c3ce64ec85a87dd8e19ddfd30154

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe

description ioc process

File opened for modification \??\PhysicalDrive0 5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2020 1208 WerFault.exe 5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe

pid	pid_target	process	target process
2020	1208	WerFault.exe	5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe

description	pid	process	target process
PID 1208 wrote to memory of 2020	1208	5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe	WerFault.exe
PID 1208 wrote to memory of 2020	1208	5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe	WerFault.exe
PID 1208 wrote to memory of 2020	1208	5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe	WerFault.exe
PID 1208 wrote to memory of 2020	1208	5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe
"C:\Users\Admin\AppData\Local\Temp\5c0ed074bcf94fb85b7e55cedf0ce65955521c96defca6e90df967696e741312.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 220
2⤵
- Program crash
PID:2020

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-54-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download
memory/1208-56-0x0000000000400000-0x00000000005B9000-memory.dmp

Filesize
1.7MB

Download
memory/1208-57-0x00000000003B0000-0x00000000003F2000-memory.dmp

Filesize
264KB

Download
memory/2020-55-0x0000000000000000-mapping.dmp

Download