01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f

General

Target

01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
Size

328KB
MD5

2a60a1830454a76af3bb9bcf4551e5f9
SHA1

107f824ff83871a8a1488b842945ef3eb1e2a0de
SHA256

01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f
SHA512

7b48194a2acbb4eff587a9fd014f55fa326f40559b40539ea68c4b1c49f93a733f56f1e4419555a78a172cae2d760616a6143a97dedaca9743b6aea04c6e3da4

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe

description	ioc	process
File opened (read-only)	\??\g:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\s:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\v:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\x:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\z:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\y:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\e:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\f:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\i:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\l:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\p:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\q:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\j:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\o:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\r:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\w:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\h:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\k:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\m:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\n:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\t:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
File opened (read-only)	\??\u:	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe

description ioc process

File opened for modification \??\PhysicalDrive0 01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe

C:\Users\Admin\AppData\Local\Temp\01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe
"C:\Users\Admin\AppData\Local\Temp\01ba3bafbd46d13793b021ee66705b3d6c7e451121a1cb48a4a8bb5460db282f.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:4580