c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9.exe
Size

3.5MB
MD5

243145f5b1c859bcf1473dc332ecb95e
SHA1

a7c039fd256e9b7939400b9286051deb102d5c47
SHA256

c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9
SHA512

4c81d9005525fcbfd1d7ddc328c434908ca909f5d01e7b228c43163b81f577631b07aa7ccfaf3d5e565e72318d30144a10f4a6597ca7bfee51dd521ff35c4590
SSDEEP

49152:v+wzGIZZ/01NG9bNypGXWk7CUF9+UUTOexfHiWg8j4JxIMAU5PyMeTajSLHOBCo0:mUGOZ/4WT57CUeDxKtnAYqNTgjcKg

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
8	systeminfo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4444	c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9.exe
4444	c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3224	4444	c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9.exe	84
PID 4444 wrote to memory of 3224	4444	c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9.exe	84
PID 4444 wrote to memory of 3224	4444	c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9.exe	84
PID 3224 wrote to memory of 8	3224	cmd.exe	86
PID 3224 wrote to memory of 8	3224	cmd.exe	86
PID 3224 wrote to memory of 8	3224	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9.exe
"C:\Users\Admin\AppData\Local\Temp\c0176891a44d7a205efa8eed64db2a167b2a02624198021fa3fadfd21a0228e9.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c systeminfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads