01a9a9b156742cc772199c4fd42d0fae47859f18aaf31f124b1189e8663404ec | Triage

Analysis

max time kernel
125s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
23-05-2022 18:36

Sharing

Report Analysis Logs

General

Target

01a9a9b156742cc772199c4fd42d0fae47859f18aaf31f124b1189e8663404ec.exe
Size

4.3MB
MD5

a78c58bb3b45ee7e5866c89830c74d31
SHA1

fe388b20e1ae84152af170048fb8530dfa5302ca
SHA256

01a9a9b156742cc772199c4fd42d0fae47859f18aaf31f124b1189e8663404ec
SHA512

311de79ef817e7b5318366854c7ffa170e6459bd63a3b083aa29f3b8c0af129113377dcd6ca58e47a63320fe2242c775865559384072757ed4b585fd3e23475b

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

01a9a9b156742cc772199c4fd42d0fae47859f18aaf31f124b1189e8663404ec.exe

description ioc process

File opened for modification \??\PhysicalDrive0 01a9a9b156742cc772199c4fd42d0fae47859f18aaf31f124b1189e8663404ec.exe

C:\Users\Admin\AppData\Local\Temp\01a9a9b156742cc772199c4fd42d0fae47859f18aaf31f124b1189e8663404ec.exe
"C:\Users\Admin\AppData\Local\Temp\01a9a9b156742cc772199c4fd42d0fae47859f18aaf31f124b1189e8663404ec.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:4948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...