c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb

Analysis

max time kernel
185s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:19

Target

c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb.exe
Size

1013KB
MD5

2c40c613749264799d97f7662cd817cc
SHA1

b41a2dac0b45ce77323e94f4a49eb734e1ff353b
SHA256

c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb
SHA512

73d8438460dabae4be5b20ad5a509c09b57fd5e211c1792bc5fc35de410ac99e3efe8e4a504a30c50815c53855f146f7f8476d61180efdd3c298f520b997c7eb
SSDEEP

24576:rEPrVEkNwwouWihUW3cfwspt82UmVTSv:4CMorfb82UmVTSv

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb.exe

description ioc process

File opened for modification \??\PhysicalDrive0 c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4836 PING.EXE

description	ioc	process
File opened for modification	\??\PhysicalDrive0	c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb.exe

pid	process
4836	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb.execmd.exe

description	pid	process	target process
PID 4308 wrote to memory of 4916	4308	c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb.exe	cmd.exe
PID 4308 wrote to memory of 4916	4308	c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb.exe	cmd.exe
PID 4308 wrote to memory of 4916	4308	c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb.exe	cmd.exe
PID 4916 wrote to memory of 4836	4916	cmd.exe	PING.EXE
PID 4916 wrote to memory of 4836	4916	cmd.exe	PING.EXE
PID 4916 wrote to memory of 4836	4916	cmd.exe	PING.EXE

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\c96f60d5148757fbc046a167dc6864cd90b0f3a5ec7673e43a8c8281c6c2a9fb.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4916

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:4836

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact