407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe
Size

3.6MB
MD5

722149e3b85a55daa0fec78a757c8a90
SHA1

3c9147bb8a5214551c7f4654ff32f992ecf47450
SHA256

407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f
SHA512

7f6cdf62d4e752d5895470604024bb952a485d10ecacf4fb2431c7a06341c36c461571bd752fd76910246d6bd908447f8ceda44210bfde7f02850b65864c4a46
SSDEEP

49152:nP/X4JxT+/jUROugaa/mxu/+RVgZMjf4r+AQPYAZGYd1iDL2:P/XgxT+T6umRyem+tQAZ71s

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe

description ioc process

File opened for modification \??\PhysicalDrive0 407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1648 2512 WerFault.exe 407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe

description pid process

Token: SeDebugPrivilege 2512 407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe

pid	pid_target	process	target process
1648	2512	WerFault.exe	407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe

description	pid	process
Token: SeDebugPrivilege	2512	407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe

description	pid	process	target process
PID 2512 wrote to memory of 1648	2512	407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe	WerFault.exe
PID 2512 wrote to memory of 1648	2512	407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe	WerFault.exe
PID 2512 wrote to memory of 1648	2512	407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe	WerFault.exe
PID 2512 wrote to memory of 1648	2512	407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe
"C:\Users\Admin\AppData\Local\Temp\407b02401a0b3421ff24f066a446a4761f1bd7e7a316ea9416bb3dd830a3c94f.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 436
2⤵
- Program crash
PID:1648

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads