a7ad1a6da118261e786af48f77d20b9383fb309332d91f10557ef396c4ef563d | Triage

Analysis

max time kernel
35s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 14:07

Sharing

Report Analysis Logs

General

Target

a7ad1a6da118261e786af48f77d20b9383fb309332d91f10557ef396c4ef563d.exe
Size

956KB
MD5

acbba5f9b4df24e1bbe49ff7ca242f80
SHA1

27cc313540e8ea4b63b68a3cd232f2ddad0a5dc8
SHA256

a7ad1a6da118261e786af48f77d20b9383fb309332d91f10557ef396c4ef563d
SHA512

3581f7f3a35403208849058b8fa809c0fcc4c6e59a2abe5cdfd3e2690ee0943912d126354ff446ed80478fb3245bd71a436fba8fd7fb9d783f2fcae33b7f5e66

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

a7ad1a6da118261e786af48f77d20b9383fb309332d91f10557ef396c4ef563d.exe

description ioc process

File opened for modification \??\PhysicalDrive0 a7ad1a6da118261e786af48f77d20b9383fb309332d91f10557ef396c4ef563d.exe

C:\Users\Admin\AppData\Local\Temp\a7ad1a6da118261e786af48f77d20b9383fb309332d91f10557ef396c4ef563d.exe
"C:\Users\Admin\AppData\Local\Temp\a7ad1a6da118261e786af48f77d20b9383fb309332d91f10557ef396c4ef563d.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:872

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/872-56-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/872-55-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download