011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1

General

Target

011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
Size

725KB
MD5

48ffcfc22793074631201ff0818f4776
SHA1

60f74add4413b4a4ceaaa7bff81862cb444e9fed
SHA256

011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1
SHA512

fb3d8909912948abdf0132f95dff805821d7f13f302061a85c82dd483cb9ff5208c168c5d5e0acc5f61185329d5aeddc0621d0c560fb82b6eb6f4f0dddfc6e2f

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe

description	ioc	process
File opened (read-only)	\??\h:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\v:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\j:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\l:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\e:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\g:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\n:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\o:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\p:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\t:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\w:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\y:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\f:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\i:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\z:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\q:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\r:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\s:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\u:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\x:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\k:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
File opened (read-only)	\??\m:	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe

description ioc process

File opened for modification \??\PhysicalDrive0 011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe

C:\Users\Admin\AppData\Local\Temp\011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe
"C:\Users\Admin\AppData\Local\Temp\011adfa5de15df473fa0926b1a952cf1c6100ffe32fc4d5a8c7c01fa054817f1.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:3600