Overview

overview

7

Static

static

3

023fb29a93...cc.exe

windows7-x64

7

023fb29a93...cc.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 14:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    023fb29a93c3181bd9ca892142450acc.exe

  • Size

    112KB

  • MD5

    023fb29a93c3181bd9ca892142450acc

  • SHA1

    7d6718ee2cbdbb6989a0965a89e0d95fd6043bfb

  • SHA256

    7f25cd4ce531ffef311af6881ed1392abc2b3a02a1a7f99cc400068a3d5be522

  • SHA512

    a5054f0537b5e1094d659508a29911c3d976550d1b70e9c1ae24342b1d96db6d65623c3796cd13ac5735ff60ff675071e7b185b7be75e45a50b1936f89bb8380

  • SSDEEP

    3072:+/lqgOxh4RpR9qf8IfEsN3A5kNu1Q6JTz:+DtnhstN3i8u1Q6J

Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\023fb29a93c3181bd9ca892142450acc.exe
    "C:\Users\Admin\AppData\Local\Temp\023fb29a93c3181bd9ca892142450acc.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 1584
      2⤵
      • Program crash
      PID:2936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2140-1-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2140-0-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

    Download

  • memory/2140-2-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

    Download

  • memory/2140-3-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

    Download

  • memory/2140-4-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2140-24-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

    Download

  • memory/2140-28-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

    Download