c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2

Analysis

max time kernel
54s
max time network
57s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 19:35

Target

c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2.exe
Size

972KB
MD5

4222d11ba37d5b8884b4e45ca8aeecee
SHA1

221b7b5378a33811d0caefa955f3a693f7fe3da2
SHA256

c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2
SHA512

db2a28e904bc5a15a52c99fb5f156b945d159fef2cd373146e6eedb6492f66c5503725bea76eadc77aabbdfbe7b3157c2cfe99a10cc62f72ec91e40c392895bf
SSDEEP

12288:npZ7RqTHG1GtRmjWjRlgivK2YyUxUi2MOOpnjuNIOHeOPYxYIswU6fsDukauZHcO:f7YTmhUlV4xUlOJjuN5HeU+hX9etGj

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1124 cmd.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2.exe

description ioc process

File opened for modification \??\PhysicalDrive0 c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1248 PING.EXE

pid	process
1124	cmd.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2.exe

pid	process
1248	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2.execmd.exe

description	pid	process	target process
PID 304 wrote to memory of 1124	304	c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2.exe	cmd.exe
PID 304 wrote to memory of 1124	304	c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2.exe	cmd.exe
PID 304 wrote to memory of 1124	304	c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2.exe	cmd.exe
PID 304 wrote to memory of 1124	304	c4a7a030fea08c1b293f1450333a0b226d7ab75928a1adb6e6a51f7e391748e2.exe	cmd.exe
PID 1124 wrote to memory of 1248	1124	cmd.exe	PING.EXE
PID 1124 wrote to memory of 1248	1124	cmd.exe	PING.EXE
PID 1124 wrote to memory of 1248	1124	cmd.exe	PING.EXE
PID 1124 wrote to memory of 1248	1124	cmd.exe	PING.EXE

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:1248

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/304-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1124-55-0x0000000000000000-mapping.dmp

Download
memory/1248-56-0x0000000000000000-mapping.dmp

Download