0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164

General

Target

0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
Size

241KB
MD5

7cbd93a57cf7497b96bc794a40884e95
SHA1

69b983366ef31fc63115a931dd59ff830aecec59
SHA256

0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164
SHA512

7c528908231ae92d098f9cd0d9717db952b4e6a52be2eb6c9c2c6b5b182ffdef83a7ad068f69617cf8cf04850bec0c57da0e36ef0aec8561c754c824d76fb812

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe

description	ioc	process
File opened (read-only)	\??\i:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\q:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\w:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\f:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\j:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\l:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\p:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\s:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\t:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\u:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\g:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\v:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\y:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\e:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\h:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\k:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\m:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\n:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\o:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\r:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\x:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
File opened (read-only)	\??\z:	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe

description ioc process

File opened for modification \??\PhysicalDrive0 0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe

C:\Users\Admin\AppData\Local\Temp\0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe
"C:\Users\Admin\AppData\Local\Temp\0214a44421d5818abd370db2f39ede6aa8573bbe4fd3dcf85d2295bb1e585164.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:1392