5e1e21f19f72bc4d092c5e1bbaf60f143193c8230a894a70b1e15e6fcc5c55e9

Analysis

max time kernel
166s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e1e21f19f72bc4d092c5e1bbaf60f143193c8230a894a70b1e15e6fcc5c55e9.dll
Size

2.5MB
MD5

8e5a651d0b0c4088a4e34ac9091c05d7
SHA1

6033b7c8fb7ebd6176a98d09cd2ee0afa1fe5cb7
SHA256

5e1e21f19f72bc4d092c5e1bbaf60f143193c8230a894a70b1e15e6fcc5c55e9
SHA512

a47599c15ce45a678e35d6e8b4a486208d867e5e7af4b5d29e2d4d210b51e0f4d3607fd0762fa20bf1b0c9a926fdc26d9253c4a55efae40bb0dc2db0ca9bc376
SSDEEP

49152:tVPOE69onqxGYOP00L1KqQYwH5wfUaqXuY1v:UGqEP00AqQX5XLXuY1v

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

1912 rundll32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process

PID 1912 set thread context of 0 1912 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4952 1912 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

pid	process
1912	rundll32.exe

description	pid	process
PID 1912 set thread context of 0	1912	rundll32.exe

pid	pid_target	process	target process
4952	1912	WerFault.exe	rundll32.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

1912 rundll32.exe

pid	process
1912	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1632 wrote to memory of 1912	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1912	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1912	1632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e1e21f19f72bc4d092c5e1bbaf60f143193c8230a894a70b1e15e6fcc5c55e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e1e21f19f72bc4d092c5e1bbaf60f143193c8230a894a70b1e15e6fcc5c55e9.dll,#1
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 748
3⤵
- Program crash
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1912 -ip 1912
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-132-0x0000000000000000-mapping.dmp

Download
memory/1912-133-0x0000000010000000-0x0000000010274000-memory.dmp

Filesize
2.5MB

Download
memory/1912-134-0x0000000010000000-0x0000000010274000-memory.dmp

Filesize
2.5MB

Download