a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 21:15

Target

a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150.exe
Size

813KB
MD5

692065a54dcc974b9ebd167a39b708a0
SHA1

e8d2baddc90a9c26916375601776685f50e0378d
SHA256

a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150
SHA512

fc52cc0635035b28f86327345874740954936c52e4e8ffc84bcfca0f23661ffe7c5072f8a7608a5367ce9f98cb541d3c5592e0da6ce549369b10118340e15e5d
SSDEEP

12288:q24Y24N7N7xiiu3C5gkROzUJmka/tB2+udrhq8IWW92wu/BnRT933pRH+004xkTP:Uz4NZfmkgt1uFNwu/X1z3O9UuiDm

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1544 cmd.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150.exe

description ioc process

File opened for modification \??\PhysicalDrive0 a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

816 PING.EXE

pid	process
1544	cmd.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150.exe

pid	process
816	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150.execmd.exe

description	pid	process	target process
PID 2028 wrote to memory of 1544	2028	a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150.exe	cmd.exe
PID 2028 wrote to memory of 1544	2028	a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150.exe	cmd.exe
PID 2028 wrote to memory of 1544	2028	a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150.exe	cmd.exe
PID 2028 wrote to memory of 1544	2028	a551a561dd9406a23526e439c72c12910e2b7c8fa0855983b0bb116cbfb58150.exe	cmd.exe
PID 1544 wrote to memory of 816	1544	cmd.exe	PING.EXE
PID 1544 wrote to memory of 816	1544	cmd.exe	PING.EXE
PID 1544 wrote to memory of 816	1544	cmd.exe	PING.EXE
PID 1544 wrote to memory of 816	1544	cmd.exe	PING.EXE

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:816

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/816-56-0x0000000000000000-mapping.dmp

Download
memory/1544-55-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download