Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 22:22
Static task
static1
Behavioral task
behavioral1
Sample
8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe
Resource
win10v2004-20220812-en
General
-
Target
8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe
-
Size
1013KB
-
MD5
f7adad3935f3641363cc1f61e7eff24f
-
SHA1
f3e667bb4c25951613fc2936f90d2e086993eab1
-
SHA256
8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408
-
SHA512
56d679784dece8ea5922c0969ac292b33f38b3bbe340edb73d8ef07b483affb23c19776cf2f23ed24c10df781218776da160399c19ac1f04ec6c3286525fafdb
-
SSDEEP
24576:rEPrVEkNwwouWihUW3cfwspt82UKVTSv:4CMorfb82UKVTSv
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 996 cmd.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exedescription ioc process File opened for modification \??\PhysicalDrive0 8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.execmd.exedescription pid process target process PID 1184 wrote to memory of 996 1184 8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe cmd.exe PID 1184 wrote to memory of 996 1184 8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe cmd.exe PID 1184 wrote to memory of 996 1184 8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe cmd.exe PID 1184 wrote to memory of 996 1184 8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe cmd.exe PID 996 wrote to memory of 2000 996 cmd.exe PING.EXE PID 996 wrote to memory of 2000 996 cmd.exe PING.EXE PID 996 wrote to memory of 2000 996 cmd.exe PING.EXE PID 996 wrote to memory of 2000 996 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe"C:\Users\Admin\AppData\Local\Temp\8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\8eb8ce5eb5547a38069af164766a508b03d4ad96d75680f59fbebce6d3ef2408.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- Runs ping.exe
PID:2000