f4dee0cecf7b7ed1a41bd5ea69220cffd7df10aba4fe04ff16059acdc298b5f1 | Triage

Analysis

max time kernel
81s
max time network
124s
platform
windows10_x64
resource
win10-en-20211104
submitted
25-11-2021 16:15

Sharing

Report Analysis Logs

General

Target

f4dee0cecf7b7ed1a41bd5ea69220cffd7df10aba4fe04ff16059acdc298b5f1.exe
Size

616KB
MD5

757d23d02910cadc8be7bd301131734d
SHA1

86891dd385b57c78424a58e3464d2636f700ba9f
SHA256

f4dee0cecf7b7ed1a41bd5ea69220cffd7df10aba4fe04ff16059acdc298b5f1
SHA512

512b0d040ebefb27c08b7d3a5433f0febc5839fe3391415f44d35f664d7381d1d6bfde20b6fe4f72d3eb0f12bbff3474bbea61cfe49f7c742e047c454c2fc0d1

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

f4dee0cecf7b7ed1a41bd5ea69220cffd7df10aba4fe04ff16059acdc298b5f1.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 f4dee0cecf7b7ed1a41bd5ea69220cffd7df10aba4fe04ff16059acdc298b5f1.exe

C:\Users\Admin\AppData\Local\Temp\f4dee0cecf7b7ed1a41bd5ea69220cffd7df10aba4fe04ff16059acdc298b5f1.exe
"C:\Users\Admin\AppData\Local\Temp\f4dee0cecf7b7ed1a41bd5ea69220cffd7df10aba4fe04ff16059acdc298b5f1.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:3064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-118-0x0000000001CB9000-0x0000000001D19000-memory.dmp

Filesize
384KB

Download
memory/3064-119-0x0000000003890000-0x00000000038FB000-memory.dmp

Filesize
428KB

Download
memory/3064-120-0x0000000000400000-0x0000000001C50000-memory.dmp

Filesize
24.3MB

Download
memory/3064-121-0x0000000000400000-0x0000000001C50000-memory.dmp

Filesize
24.3MB

Download