6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe
Size

10.0MB
MD5

66219024e53de4e027031aa9d6ebcc82
SHA1

7df545baddc768d329d65e58356233ca6a81da56
SHA256

6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3
SHA512

c50401e4b395dfc70ca8d92ca8513c3bfef943c594f26d97ab3561b5fbe14c043a892c5c5c77f4aa2e967ab5682462aeb7d26c7f889adb7d52b4be37659197dc
SSDEEP

196608:m14UdVEy9qMBNLtIwzPKf0IuX8CAd2XsYsALjC:E4UdVEy9qMBNLtRl/XLFdPC

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe

pid	process
1488	6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe
1488	6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe

description ioc process

File opened for modification \??\PhysicalDrive0 6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4144 1488 WerFault.exe 6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe

pid	pid_target	process	target process
4144	1488	WerFault.exe	6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe

C:\Users\Admin\AppData\Local\Temp\6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe
"C:\Users\Admin\AppData\Local\Temp\6407cdb3f06e124045fcada73f5df43965bb5bdfc6d07085c12029a6b38ff1b3.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 1536
2⤵
- Program crash
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1488 -ip 1488
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\netul.dll

Filesize
1.9MB

MD5
b434b1eff14158cb7708d70478b4f89a

SHA1
3e1411c5d7a5cffcf3c0b998cc7ea0b187c90ffb

SHA256
e62f24419a4e9a511f95183a276b6eb27a685c64f37b9f2449ab993d33e9d708

SHA512
303809947f45576cee4690fc90a85840d805bc42da2a0737f9f64d58b4ad5b170c5b3cbc89e3d12b1d7d0d554f87d22bb33644a64ad587d201d7fb47d43b0b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0CC334B7-53A1-4756-A51B-C0CFAB2813DE}.tmp\7z.dll

Filesize
1.1MB

MD5
f0fef6362d4886e85a186a5e3766650a

SHA1
65843b7052a4d1b84762479d79445c46834e18b5

SHA256
15b9fe7d408cbf2204039087526e7df947df57b42ea479e303b682e956638816

SHA512
3f6dfd701cf62b77219f8825a2257c4bd7d44ebafc5654b06abaf906ced2571f4eeb04fe22ae6136c14bddebddb12555aa6efd322e779443d57bb122ea786043

Download Submit