Overview

overview

6

Static

static

2e8a83ceff559f...5e.exe

windows7_x64

6

2e8a83ceff559f...5e.exe

windows10-2004_x64

6
General
Target

2e8a83ceff559f8df9b5bea70ea2224a6fe93edbd19b75db8c6e512d3c5eb35e.exe

Filesize

893KB

Completed

21-05-2022 12:40

Task

behavioral2

Score
6/10
MD5

32020b2dffc1a7f9d4166be24f92bac9

SHA1

56cb28de7e4f7f0972b5514f00afb2c56d1a2450

SHA256

2e8a83ceff559f8df9b5bea70ea2224a6fe93edbd19b75db8c6e512d3c5eb35e

SHA256

56fc1adbfcc9ace262182256b63f379e062fe9aa947bcfb017dea984d7ac2aad0bdb6d748a1f459fd7bf40d8e54904971aec5a4f11ab512b7868af531bb18b8f

Malware Config
Signatures 2

Filter: none

Persistence
  • Writes to the Master Boot Record (MBR)
    2e8a83ceff559f8df9b5bea70ea2224a6fe93edbd19b75db8c6e512d3c5eb35e.exe

    Description

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    Tags

    TTPs

    Bootkit

    Reported IOCs

    descriptioniocprocess
    File opened for modification\??\PhysicalDrive02e8a83ceff559f8df9b5bea70ea2224a6fe93edbd19b75db8c6e512d3c5eb35e.exe
  • Suspicious behavior: EnumeratesProcesses
    2e8a83ceff559f8df9b5bea70ea2224a6fe93edbd19b75db8c6e512d3c5eb35e.exe

    Reported IOCs

    pidprocess
    26282e8a83ceff559f8df9b5bea70ea2224a6fe93edbd19b75db8c6e512d3c5eb35e.exe
    26282e8a83ceff559f8df9b5bea70ea2224a6fe93edbd19b75db8c6e512d3c5eb35e.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\2e8a83ceff559f8df9b5bea70ea2224a6fe93edbd19b75db8c6e512d3c5eb35e.exe
    "C:\Users\Admin\AppData\Local\Temp\2e8a83ceff559f8df9b5bea70ea2224a6fe93edbd19b75db8c6e512d3c5eb35e.exe"
    Writes to the Master Boot Record (MBR)
    Suspicious behavior: EnumeratesProcesses
    PID:2628
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads