201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
18/11/2023, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c.exe
Size

1.0MB
MD5

989f3f78e03f5da737d2653d6cc6d1bd
SHA1

aab0304373f4b00f95c51ddc8fece61fde76659c
SHA256

201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c
SHA512

800ad474f24d1ed8f48cedbcb4355ffb0016bf5d87500904e9b1795fe61e9ad9a52275aa5fbb13b9d6a1fdd616614f1e9ab1dd7eb8f39e3c1cfa8b6462486883
SSDEEP

12288:G/kTLQNpHazRSiU1/NrjSDA6lBvbe3l9wRTumbjPOUggM+n9IrJ1d/5S+uDfoqD1:FTLwp6FfUtMpna17usqDazpRNeXT4W

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2400	1128	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2400	1128	201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c.exe	27
PID 1128 wrote to memory of 2400	1128	201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c.exe	27
PID 1128 wrote to memory of 2400	1128	201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c.exe	27
PID 1128 wrote to memory of 2400	1128	201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c.exe	27

C:\Users\Admin\AppData\Local\Temp\201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c.exe
"C:\Users\Admin\AppData\Local\Temp\201d483d7b3776ab0457663038247ec7c09c811b04c0c5b77c9eca18be12a45c.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 340
  2⤵
  - Program crash
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads