6feed7d5f7d9776c69963076fdb46de01b8ff9253a84b9e086e0beefc85a181d

Analysis

max time kernel
6s
max time network
11s
platform
windows10_x64
resource
win10v20201028
submitted
29/12/2020, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
c762341624a305f91883921f9f17d3eb.exe
Size 541KB
Sample201229-9ktrf9ctjs
SHA256 6feed7d5f7d9776c69963076fdb46de01b8ff9253a84b9e086e0beefc85a181d
MD5 c762341624a305f91883921f9f17d3eb
SHA1 434637dbff391e4c0012fa493d53ef571a465c07
SHA512 b1496064edaa89f210c352f2425f6fea00ddeeb331fd2d9f28496122a54ca71f6dee5f4dd35dffbb31f41dda14f86dc4073f242871101b6d34d8153b3d276045
MD5 SHA1 SHA512

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	c762341624a305f91883921f9f17d3eb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	652	c762341624a305f91883921f9f17d3eb.exe

C:\Users\Admin\AppData\Local\Temp\c762341624a305f91883921f9f17d3eb.exe
"C:\Users\Admin\AppData\Local\Temp\c762341624a305f91883921f9f17d3eb.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-2-0x0000000004EE6000-0x0000000004EE7000-memory.dmp

Download

memory/652-3-0x0000000005430000-0x0000000005431000-memory.dmp