91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9

Analysis

max time kernel
33s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe
Size

404KB
MD5

3c1f82d97dea449aac36eb44074a0b89
SHA1

262784ea56936f77c3494e7fe08bc6b14e8890ff
SHA256

91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9
SHA512

e4bb0af84f4ef4fbd2a0d58b458d85502db3af0dbff96dd7685461432df98e5606626fc0251e18898d65ff0296e59dc6abbfeb69f94102248dbd184e729f7bae
SSDEEP

6144:gpmlIqsRvgay92NgvpnoJtEhjbyym2JIQGyKWbgP2l87aW9ubgIM7sJdk4uH:g2sRIay2anwWh3fCkbgel8b537sJCXH

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 836	2044	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	836	WerFault.exe	27

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 836	2044	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	27
PID 2044 wrote to memory of 836	2044	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	27
PID 2044 wrote to memory of 836	2044	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	27
PID 2044 wrote to memory of 836	2044	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	27
PID 2044 wrote to memory of 836	2044	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	27
PID 2044 wrote to memory of 836	2044	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	27
PID 836 wrote to memory of 2036	836	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	28
PID 836 wrote to memory of 2036	836	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	28
PID 836 wrote to memory of 2036	836	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	28
PID 836 wrote to memory of 2036	836	91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe	28

C:\Users\Admin\AppData\Local\Temp\91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe
"C:\Users\Admin\AppData\Local\Temp\91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe
  C:\Users\Admin\AppData\Local\Temp\91107564b681acf1c32df9cc527510cdc3c17204339ad6fc95c371ab298755d9.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 180
    3⤵
    - Program crash
    PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-54-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-63-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/836-64-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2044-59-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/2044-60-0x0000000000260000-0x000000000029A000-memory.dmp

Filesize
232KB

Download