Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 22:31
Static task
static1
Behavioral task
behavioral1
Sample
aa74c6be443108ea164912a4e0a906b7294bf833417162d665b4601e20da63c3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aa74c6be443108ea164912a4e0a906b7294bf833417162d665b4601e20da63c3.exe
Resource
win10v2004-20220812-en
General
-
Target
aa74c6be443108ea164912a4e0a906b7294bf833417162d665b4601e20da63c3.exe
-
Size
281KB
-
MD5
4ac318932cafe769fa5beb33b573b182
-
SHA1
1d31b5a44403dabb016be31b70602f845eb363b9
-
SHA256
aa74c6be443108ea164912a4e0a906b7294bf833417162d665b4601e20da63c3
-
SHA512
8d92992b6e8c911fed67d9f1e81a77274b7066a7c8fd02b893a98448ebc7167ab5dd1d5f1b398b956ddd407e0bad981e7edd76a3a6530f35702e544e514dd845
-
SSDEEP
6144:YwUXOmBORmWfD05CKUwmTaQIeXA1DbDFH/mgmv8Zz:YwCOmgrbFdA1PZH/cvmz
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
aa74c6be443108ea164912a4e0a906b7294bf833417162d665b4601e20da63c3.exedescription ioc process File opened for modification \??\PhysicalDrive0 aa74c6be443108ea164912a4e0a906b7294bf833417162d665b4601e20da63c3.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1884-54-0x0000000075571000-0x0000000075573000-memory.dmpFilesize
8KB
-
memory/1884-55-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-152-0x0000000000400000-0x000000000048F000-memory.dmpFilesize
572KB
-
memory/1884-159-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-441-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-448-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-446-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-451-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-453-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-455-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-459-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-461-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-463-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-464-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-467-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-468-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-471-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-473-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-477-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-479-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-481-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-482-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-485-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-753-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-756-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-759-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-761-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-767-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-1034-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-1039-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-1083-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-1084-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-1085-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB
-
memory/1884-1086-0x0000000002830000-0x00000000028DA000-memory.dmpFilesize
680KB