b0037c1e5be7b7736498679b44439e5062a6126e10ddc8e3a8acbc638e5b222d

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2023 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0037c1e5be7b7736498679b44439e5062a6126e10ddc8e3a8acbc638e5b222d.exe
Size

4.2MB
MD5

ad794c57d0acfa24f248619d668fe9bd
SHA1

8abd5653a21a88e222a7030251eb65e021ae4074
SHA256

b0037c1e5be7b7736498679b44439e5062a6126e10ddc8e3a8acbc638e5b222d
SHA512

23f4f525f6711b84f0a384734487ccc26f4084cb43cff61dcf558b1a85d42c9fb76bc7ac6e1c0cd3d71c2b62f748240d12626099de5e376f859ad354f4c7f725
SSDEEP

98304:2ILqEzQUQaxNU7+JpbXFjWKz6zrD/ty4GShylpYm:vqkvZx2ipbXVWKzgfly4XIi

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b0037c1e5be7b7736498679b44439e5062a6126e10ddc8e3a8acbc638e5b222d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4752	b0037c1e5be7b7736498679b44439e5062a6126e10ddc8e3a8acbc638e5b222d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	4752	WerFault.exe	88

C:\Users\Admin\AppData\Local\Temp\b0037c1e5be7b7736498679b44439e5062a6126e10ddc8e3a8acbc638e5b222d.exe
"C:\Users\Admin\AppData\Local\Temp\b0037c1e5be7b7736498679b44439e5062a6126e10ddc8e3a8acbc638e5b222d.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 264
  2⤵
  - Program crash
  PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4752 -ip 4752
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4752-0-0x0000000000400000-0x0000000000A94000-memory.dmp

Filesize
6.6MB

Download
memory/4752-1-0x0000000002950000-0x0000000002A23000-memory.dmp

Filesize
844KB

Download
memory/4752-2-0x0000000000400000-0x0000000000A94000-memory.dmp

Filesize
6.6MB

Download
memory/4752-3-0x0000000002950000-0x0000000002A23000-memory.dmp

Filesize
844KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads