471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 02:04

Target

471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67.exe
Size

972KB
MD5

4ad5518f25fb623058d74839a22570e1
SHA1

8acaeaf3c22f513124f64d2954b65a7df0f64c40
SHA256

471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67
SHA512

4de4a667d9ffb86cc304db617bb6028f6b49d4013f53b99f2b75233c476dd8d2e9aa3343398a290c0a2f40cad59a6c876c77d5ef862609c7e868422c719bdbef
SSDEEP

12288:npZ7RqTHG1GtRmjWjRlgivK2YyUxUi2MOOpnjuNIOHeOPYxYIswU6fsDukauZHcu:f7YTmhUlV4xUlOJjuN5HeU+hXdetGj

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1716 cmd.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67.exe

description ioc process

File opened for modification \??\PhysicalDrive0 471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1852 PING.EXE

pid	process
1716	cmd.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67.exe

pid	process
1852	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67.execmd.exe

description	pid	process	target process
PID 900 wrote to memory of 1716	900	471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67.exe	cmd.exe
PID 900 wrote to memory of 1716	900	471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67.exe	cmd.exe
PID 900 wrote to memory of 1716	900	471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67.exe	cmd.exe
PID 900 wrote to memory of 1716	900	471112758921a033854c1732c4242ac7b6811ce915719fb94023b11050d53c67.exe	cmd.exe
PID 1716 wrote to memory of 1852	1716	cmd.exe	PING.EXE
PID 1716 wrote to memory of 1852	1716	cmd.exe	PING.EXE
PID 1716 wrote to memory of 1852	1716	cmd.exe	PING.EXE
PID 1716 wrote to memory of 1852	1716	cmd.exe	PING.EXE

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:1852

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/900-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1716-55-0x0000000000000000-mapping.dmp

Download
memory/1852-56-0x0000000000000000-mapping.dmp

Download