935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae

Analysis

max time kernel
217s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:42

Target

935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae.exe
Size

883KB
MD5

09f050c10db97929c8fea54bb4d62508
SHA1

89f5ee58536f00cf564226a4c6637e0dc1ac3346
SHA256

935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae
SHA512

3ec72486e5d5959778ff5ac2e56687a175f0cd071ca29ccea77f26dd34ee1b22f93b67e135ef904fbd7c3dce2e65cd8328bf5929a3d6ee973bef15ab64371e5c
SSDEEP

12288:gm+eQydQu3K27bMuLBJic2Lb3eKLhklAwWmTu8S6u6v3Ic7rvDRUWFgwMqYUhcYI:g9m7SlnxhklQm3tUg8c+md2

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1752 cmd.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae.exe

description ioc process

File opened for modification \??\PhysicalDrive0 935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2012 PING.EXE

pid	process
1752	cmd.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae.exe

pid	process
2012	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae.execmd.exe

description	pid	process	target process
PID 340 wrote to memory of 1752	340	935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae.exe	cmd.exe
PID 340 wrote to memory of 1752	340	935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae.exe	cmd.exe
PID 340 wrote to memory of 1752	340	935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae.exe	cmd.exe
PID 340 wrote to memory of 1752	340	935fde514a701d9181d0d343f2082416d1661fbca9835db53a62f270bceb0dae.exe	cmd.exe
PID 1752 wrote to memory of 2012	1752	cmd.exe	PING.EXE
PID 1752 wrote to memory of 2012	1752	cmd.exe	PING.EXE
PID 1752 wrote to memory of 2012	1752	cmd.exe	PING.EXE
PID 1752 wrote to memory of 2012	1752	cmd.exe	PING.EXE

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
3⤵
- Runs ping.exe
PID:2012

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/340-54-0x0000000075671000-0x0000000075673000-memory.dmp

Filesize
8KB

Download
memory/1752-55-0x0000000000000000-mapping.dmp

Download
memory/2012-56-0x0000000000000000-mapping.dmp

Download