b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af

Analysis

max time kernel
11s
max time network
49s
platform
windows7_x64
resource
win7v20210408
submitted
14-07-2021 02:16

Sharing

Copy URL

Twitter E-mail

Reason

Remote task has failed: Machine shutdown

Report Analysis Logs

General

Target

b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af.exe
Size

601KB
MD5

c38c8e14ca3daad3bbf2910bf724751d
SHA1

b9546e120deab7fbefcaf138c923312c1d91d722
SHA256

b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af
SHA512

bbbf87f0017c288c3a78088c69158ee992cf84ef05e0cd23c7752c73a551d37085efa34c4ae41a6f54122c904671220f7fbff90e6bd29fdd37bb5b4cc3e1a69d

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af.exe

description pid process

Token: SeShutdownPrivilege 1956 b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af.exe

description	pid	process
Token: SeShutdownPrivilege	1956	b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af.exe

C:\Users\Admin\AppData\Local\Temp\b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af.exe
"C:\Users\Admin\AppData\Local\Temp\b5677c219426e082f93f8d9e137f2ce100999b02495b7288cc126a39f42de3af.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:1956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-60-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1956-61-0x0000000000220000-0x000000000028B000-memory.dmp

Filesize
428KB

Download
memory/1956-62-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download