Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 21:50
Static task
static1
Behavioral task
behavioral1
Sample
133351dacf91bf67355a02423e3e1cc6aae5bae7ccaeffad61e42f1c2334d769.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
133351dacf91bf67355a02423e3e1cc6aae5bae7ccaeffad61e42f1c2334d769.exe
Resource
win11-20240508-en
General
-
Target
133351dacf91bf67355a02423e3e1cc6aae5bae7ccaeffad61e42f1c2334d769.exe
-
Size
932KB
-
MD5
1c4234d626496e3c2501badba90fcae5
-
SHA1
11b087c5dbd9cf729393c11abbb2f3caac2bc5e9
-
SHA256
133351dacf91bf67355a02423e3e1cc6aae5bae7ccaeffad61e42f1c2334d769
-
SHA512
317c2361b05ec0a9b346c45f56b31c691fbda91d8c39d028f07f1bb712d7b8090fe5def7ec6f224aa2e5ddfb65f2a0c63f744f3d92f43064fa2d67ccf670a142
-
SSDEEP
12288:MOQNMIt3+hioijxOcaGW/v7EmEfvnJUC2+6zI4cHkYaG6U5SqFS4609bCFrZd:LWMIMhiop+4wLfvT2dMINbU5zFQmUz
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 133351dacf91bf67355a02423e3e1cc6aae5bae7ccaeffad61e42f1c2334d769.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1100 1688 WerFault.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\133351dacf91bf67355a02423e3e1cc6aae5bae7ccaeffad61e42f1c2334d769.exe"C:\Users\Admin\AppData\Local\Temp\133351dacf91bf67355a02423e3e1cc6aae5bae7ccaeffad61e42f1c2334d769.exe"1⤵
- Writes to the Master Boot Record (MBR)
PID:1688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 7002⤵
- Program crash
PID:1100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1688 -ip 16881⤵PID:516