03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2023, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Size

1.9MB
MD5

b0b93725af678ae7489e7e9ff7971c28
SHA1

910c0730c1e686e5813e7fac24b829c0e105211f
SHA256

03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f
SHA512

aaaa602c142770333f5392708ca1c6dc6985443341014efa3da01c6014dd437d2be4023e051f28337416d75453e195af18b9cd7386be0e03ff9ab824263bb08f
SSDEEP

49152:B4BQ3BcWYJOhnuiQae5ruEww216k4xIU3/gOyiUMBV:B4BQ3BcLOhnuiQaeJBgFJm/gOyiUMBV

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	1076	WerFault.exe	84

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "96988155cfa07598aa333c81cb1326a8"	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "54B6F323969BD322CA4810B279B1983D"	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}	03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe

C:\Users\Admin\AppData\Local\Temp\03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe
"C:\Users\Admin\AppData\Local\Temp\03294fe0bd5df6940768cc6f0ade99ff3d5963fe6b4c1585606119c9a428335f.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 796
  2⤵
  - Program crash
  PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1076 -ip 1076
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...