8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
Size 2.9MB
Sample261015-wsllxsdf67
SHA256 8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b
MD5 7f96773e90c1d5d8c79bba47e53e0777
SHA1 b9f247053c1c02db96c28b13ce84e1a2ccaede62
SHA512 b27d23a3b4d9c5cf889449a639066aa593280e19a0aa7ce9e8d6abd4a79e4b18869290791ee2442cad21ed1227bd094aab62902861714ba98d2bbfb3762fc1a2
SSDEEP 49152:ZWlvPeTSHlLU/a4hseXbrtvY3ORX8kcPK8UmzYDGk66PXMcHl46:Al9HJObrtvY3BFK8TavMcHl46
TLSH
T164E56B317605C023D5602871993CEB6DB04CAE355B64A4C7B3847FADDA639D3E932F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
File opened for modification	C:\Windows\System32\alg.exe	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 37 IoCs

pid	pid_target	Process	procid_target
4012	4988	WerFault.exe	87
5520	4988	WerFault.exe	87
712	4988	WerFault.exe	87
5064	4988	WerFault.exe	87
1144	4988	WerFault.exe	87
1084	4988	WerFault.exe	87
4740	4988	WerFault.exe	87
1688	4988	WerFault.exe	87
3700	4988	WerFault.exe	87
3980	4988	WerFault.exe	87
5108	4988	WerFault.exe	87
4728	4988	WerFault.exe	87
476	4988	WerFault.exe	87
1996	4988	WerFault.exe	87
3956	4988	WerFault.exe	87
6000	4988	WerFault.exe	87
5440	4988	WerFault.exe	87
5400	4988	WerFault.exe	87
1400	4988	WerFault.exe	87
3248	4988	WerFault.exe	87
3688	4988	WerFault.exe	87
5552	4988	WerFault.exe	87
984	4988	WerFault.exe	87
4336	4988	WerFault.exe	87
5424	4988	WerFault.exe	87
3140	4988	WerFault.exe	87
5804	4988	WerFault.exe	87
2148	4988	WerFault.exe	87
1524	4988	WerFault.exe	87
4136	4988	WerFault.exe	87
4220	4988	WerFault.exe	87
4696	4988	WerFault.exe	87
1896	4988	WerFault.exe	87
2208	4988	WerFault.exe	87
3744	4988	WerFault.exe	87
2344	4988	WerFault.exe	87
4532	4988	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4988	8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe

C:\Users\Admin\AppData\Local\Temp\8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe
"C:\Users\Admin\AppData\Local\Temp\8c7da6af9bf3ff9a09e0af30337ed973e114c6334fe705890cec1079ea95764b.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 724
  2⤵
  - Program crash
  PID:4012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 732
  2⤵
  - Program crash
  PID:5520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 760
  2⤵
  - Program crash
  PID:712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 900
  2⤵
  - Program crash
  PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 940
  2⤵
  - Program crash
  PID:1144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1008
  2⤵
  - Program crash
  PID:1084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1036
  2⤵
  - Program crash
  PID:4740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1036
  2⤵
  - Program crash
  PID:1688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1536
  2⤵
  - Program crash
  PID:3700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1572
  2⤵
  - Program crash
  PID:3980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1548
  2⤵
  - Program crash
  PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 752
  2⤵
  - Program crash
  PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1580
  2⤵
  - Program crash
  PID:476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1556
  2⤵
  - Program crash
  PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1592
  2⤵
  - Program crash
  PID:3956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1576
  2⤵
  - Program crash
  PID:6000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1584
  2⤵
  - Program crash
  PID:5440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1576
  2⤵
  - Program crash
  PID:5400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1604
  2⤵
  - Program crash
  PID:1400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1680
  2⤵
  - Program crash
  PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1736
  2⤵
  - Program crash
  PID:3688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1828
  2⤵
  - Program crash
  PID:5552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1724
  2⤵
  - Program crash
  PID:984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1872
  2⤵
  - Program crash
  PID:4336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 2040
  2⤵
  - Program crash
  PID:5424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 2068
  2⤵
  - Program crash
  PID:3140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 2084
  2⤵
  - Program crash
  PID:5804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 2080
  2⤵
  - Program crash
  PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1564
  2⤵
  - Program crash
  PID:1524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 2068
  2⤵
  - Program crash
  PID:4136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1876
  2⤵
  - Program crash
  PID:4220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1600
  2⤵
  - Program crash
  PID:4696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 2076
  2⤵
  - Program crash
  PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1992
  2⤵
  - Program crash
  PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 2068
  2⤵
  - Program crash
  PID:3744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1832
  2⤵
  - Program crash
  PID:2344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 184
  2⤵
  - Program crash
  PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 4988 -ip 4988
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4988 -ip 4988
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4988 -ip 4988
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4988 -ip 4988
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4988 -ip 4988
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4988 -ip 4988
1⤵
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4988 -ip 4988
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4988 -ip 4988
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4988 -ip 4988
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4988 -ip 4988
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4988 -ip 4988
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4988 -ip 4988
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4988 -ip 4988
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4988 -ip 4988
1⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 4988 -ip 4988
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 4988 -ip 4988
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4988 -ip 4988
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4988 -ip 4988
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4988 -ip 4988
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4988 -ip 4988
1⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 4988 -ip 4988
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4988 -ip 4988
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4988 -ip 4988
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4988 -ip 4988
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4988 -ip 4988
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4988 -ip 4988
1⤵
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4988 -ip 4988
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4988 -ip 4988
1⤵
PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4988 -ip 4988
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4988 -ip 4988
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4988 -ip 4988
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4988 -ip 4988
1⤵
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4988 -ip 4988
1⤵
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4988 -ip 4988
1⤵
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4988 -ip 4988
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4988 -ip 4988
1⤵
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4988 -ip 4988
1⤵
PID:672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4988-0-0x0000000002D20000-0x0000000002ED3000-memory.dmp

Download

memory/4988-1-0x0000000002EE0000-0x0000000002F65000-memory.dmp

Download

memory/4988-7-0x0000000002EE0000-0x0000000002F65000-memory.dmp

Download

memory/4988-6-0x0000000002EE0000-0x0000000002F65000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads