3efc457bcc114f42630bd1f3c0ce8c6552d1af183861d8c640428ca527e6dc6d | Triage

Analysis

max time kernel
14s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
27-07-2021 17:55

Sharing

Report Analysis Logs

General

Target

MBROverwrite.exe
Size

73KB
MD5

165bc8a39139125af4c0d0a7c7301d9d
SHA1

8e93cb2c2b7be31df379ee61f594955f8493c12c
SHA256

3efc457bcc114f42630bd1f3c0ce8c6552d1af183861d8c640428ca527e6dc6d
SHA512

7cf9a1056555e6543cddd9511f4e8f3d3e6cb69511e974d2304a555f13b846068c5ab9dc431d2ec95791ba2e8bb5537b6a9c113579461578baf00833da0f97ea

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MBROverwrite.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MBROverwrite.exe

C:\Users\Admin\AppData\Local\Temp\MBROverwrite.exe
"C:\Users\Admin\AppData\Local\Temp\MBROverwrite.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:664

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...