Analysis
-
max time kernel
64s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
23-05-2022 17:54
Static task
static1
Behavioral task
behavioral1
Sample
01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe
Resource
win10v2004-20220414-en
General
-
Target
01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe
-
Size
241KB
-
MD5
08597ea682aa7922e2ea527add61ac61
-
SHA1
fb2a2bfafb9b553cc012bfae3e132ed3a8f71c3c
-
SHA256
01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53
-
SHA512
9dcca4dc66dc043c2274ca780dcc41dc4b8f567045c6d016b9e54fa90b2fec96d0dd36330d315fc230e4a553da01c6576b0141cf110a21f813ba4877b65b10d8
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exedescription ioc process File opened (read-only) \??\q: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\w: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\g: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\f: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\h: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\j: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\k: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\n: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\s: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\x: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\e: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\z: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\y: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\m: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\o: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\p: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\i: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\r: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\t: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\u: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\v: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe File opened (read-only) \??\l: 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exedescription ioc process File opened for modification \??\PhysicalDrive0 01cedeb4decab45ed457ddcd967958095da684ca42bac7d864e73fb2f9742b53.exe