Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 13:46

General

  • Target

    a5cc5f80a371f6a35d3d8c06eed0f9550833fd1135f9dff39744f1c9fb9f4a01.exe

  • Size

    1.0MB

  • MD5

    890c3239ac02b63937c4ee2f06f73756

  • SHA1

    4c6aed71fcbd07e5be702e34887bf27d70fbb7dc

  • SHA256

    a5cc5f80a371f6a35d3d8c06eed0f9550833fd1135f9dff39744f1c9fb9f4a01

  • SHA512

    ce158529ebac31d712eb9b0506f7f9e7c77ad91f9348ad62cac639a382bf82c4132804c9be959d641d4bf5acd6c10ff3b8b4eb9e9698aa4051b3967ecb07e19d

  • SSDEEP

    12288:uswHVwi+6GvxKZ3lKlHk8fCR9LdvRh28HoWJU2QyXeTp98GF3pW5PtkJJ:up1GlpK7eVCrLdZh25kU085PrJ

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5cc5f80a371f6a35d3d8c06eed0f9550833fd1135f9dff39744f1c9fb9f4a01.exe
    "C:\Users\Admin\AppData\Local\Temp\a5cc5f80a371f6a35d3d8c06eed0f9550833fd1135f9dff39744f1c9fb9f4a01.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:3756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 732
      2⤵
      • Program crash
      PID:3556
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3756 -ip 3756
    1⤵
      PID:3280

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3756-0-0x00000000007E0000-0x00000000007E1000-memory.dmp

            Filesize

            4KB

          • memory/3756-2-0x0000000000400000-0x000000000046F000-memory.dmp

            Filesize

            444KB

          • memory/3756-1-0x0000000002820000-0x00000000028AB000-memory.dmp

            Filesize

            556KB

          • memory/3756-3-0x0000000000400000-0x0000000000508000-memory.dmp

            Filesize

            1.0MB

          • memory/3756-4-0x0000000000400000-0x0000000000508000-memory.dmp

            Filesize

            1.0MB

          • memory/3756-6-0x00000000007E0000-0x00000000007E1000-memory.dmp

            Filesize

            4KB

          • memory/3756-8-0x0000000000400000-0x000000000046F000-memory.dmp

            Filesize

            444KB