Bootkit
pewpew.exe
Windows Exe (x86-32)
Created 5 years ago
VMRay Threat Identifiers (17 rules, 145 matches)
| Severity | Category | Operation | Count | Classification | |
|---|---|---|---|---|---|
5/5 | Antivirus | Malicious content was detected by heuristic scan | 1 | - | |
5/5 | Persistence | Writes to Master Boot Record (MBR) | 1 | - | |
4/5 | User Data Modification | Modifies Windows automatic backups | 1 | - | |
3/5 | Anti Analysis | Tries to evade debugger | 1 | - | |
3/5 | User Data Modification | Possibly drops ransom note files | 1 | Ransomware | |
2/5 | Obfuscation | Resolves APIs dynamically to possibly evade static detection | 1 | - | |
2/5 | Defense Evasion | Sends control codes to connected devices | 1 | - | |
2/5 | Data Collection | Reads sensitive browser data | 1 | - | |
1/5 | Anti Analysis | Tries to detect analyzer sandbox | 1 | - | |
1/5 | System Modification | Modifies application directory | 123 | - | |
Screenshots
Monitored Processes
MITRE ATT&CK™ Matrix - Windows
ActiveAll
Version: 2019-04-25 20:53:07.719000
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Software Packing
Virtualization / Sandbox Evasion
Hidden Window
Masquerading
Credential Access
Credentials in Files
Discovery
File and Directory Discovery
Virtualization / Sandbox Evasion
System Time Discovery
Lateral Movement
Collection
Automated Collection
Data from Local System
Command and Control
Standard Application Layer Protocol
Exfiltration
Impact
Inhibit System Recovery
Sample Information
| ID | #1332866 |
| MD5 | |
| SHA1 | |
| SHA256 | |
| SSDeep | |
| ImpHash | |
| Filename | pewpew.exe |
| File Size | 1042.50 KB |
| Sample Type | Windows Exe (x86-32) |
Analysis Information
| Creation Time | 2020-09-15 22:09 (UTC+) |
| Analysis Duration | 00:04:00 |
| Number of Monitored Processes | 8 |
| Execution Successful |  |
| Reputation Enabled | |
| WHOIS Enabled |  |
| Local AV Enabled | |
| Local AV Applied On | Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps |
| YARA Enabled | |
| YARA Applied On | Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps |
| Number of AV Matches | 22 |
| Number of YARA Matches | 0 |
| Termination Reason | Timeout |
