Analysis
-
max time kernel
38s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 01:00
Static task
static1
Behavioral task
behavioral1
Sample
011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
Resource
win10v2004-20220414-en
General
-
Target
011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
-
Size
725KB
-
MD5
48ffcfc22793074631201ff0818f4776
-
SHA1
60f74add4413b4a4ceaaa7bff81862cb444e9fed
-
SHA256
011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1
-
SHA512
fb3d8909912948abdf0132f95dff805821d7f13f302061a85c82dd483cb9ff5208c168c5d5e0acc5f61185329d5aeddc0621d0c560fb82b6eb6f4f0dddfc6e2f
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exedescription ioc process File opened (read-only) \??\f: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\h: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\l: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\o: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\q: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\r: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\w: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\x: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\y: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\g: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\n: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\s: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\z: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\j: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\m: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\p: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\e: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\i: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\k: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\t: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\u: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe File opened (read-only) \??\v: 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exedescription ioc process File opened for modification \??\PhysicalDrive0 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe