017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea

General

Target

017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
Size

338KB
MD5

0bb0753a359f57725bfba965b4df2fb9
SHA1

9f66340be17a5d081e5207784a76ea42591fdee8
SHA256

017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea
SHA512

4414e1d287e1fbe47c8391aa0f30b755d1e6730b4fad90320d47d41fda161eed8d17b76bbb87a559634de2d05caabeb516660b0cc39e7f6038b570c0d827fe16

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe

description	ioc	process
File opened (read-only)	\??\x:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\e:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\l:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\m:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\q:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\u:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\y:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\g:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\k:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\o:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\j:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\r:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\s:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\v:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\f:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\h:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\i:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\w:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\z:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\n:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\p:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
File opened (read-only)	\??\t:	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe

description ioc process

File opened for modification \??\PhysicalDrive0 017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe

C:\Users\Admin\AppData\Local\Temp\017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe
"C:\Users\Admin\AppData\Local\Temp\017a6c45e57990adaf639b73207d0a90282295ccc8468c9c3a25f3e0623dceea.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:3780