0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308

General

Target

0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
Size

241KB
MD5

3ad312ee63506e736a1c686729525728
SHA1

74c0ae438aaf097b22acace9a76c89359d07670e
SHA256

0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308
SHA512

64ad4f33b779a5a054acaa92fd7b9f4f408bb937d7da583d06e330981cd97407b0c00106615581555d6bee6c99c83abad36fa0beab850a420dcb6209460f5ece

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe

description	ioc	process
File opened (read-only)	\??\t:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\v:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\y:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\r:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\l:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\o:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\q:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\u:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\x:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\h:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\i:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\j:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\m:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\w:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\z:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\g:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\f:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\k:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\n:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\p:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\s:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
File opened (read-only)	\??\e:	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe

description ioc process

File opened for modification \??\PhysicalDrive0 0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe

C:\Users\Admin\AppData\Local\Temp\0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe
"C:\Users\Admin\AppData\Local\Temp\0204d7156772e5881237177b6fd28f79740147c3072d7a3fff95a5937377a308.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:2992