83a924b07981f194a39c956a1032feb6f1ce82d286a8dcc6175f3fcc0be85a97 | Triage

Analysis

max time kernel
99s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
27-05-2022 05:42

Sharing

Report Analysis Logs

General

Target

83a924b07981f194a39c956a1032feb6f1ce82d286a8dcc6175f3fcc0be85a97.exe
Size

631KB
MD5

9bd23a6276e25209c393e9abe93ef277
SHA1

a8d339525a23c7d46b5d1b3dd486ce1e85941338
SHA256

83a924b07981f194a39c956a1032feb6f1ce82d286a8dcc6175f3fcc0be85a97
SHA512

3cda03a645557bc11da7bb4d1d03ee8818329ae88ec9f7d9ae69096256ec622f3a4173e63fcd16de0dee53d2969857b0292051681d8ebda24abf740d91ec75cf

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

83a924b07981f194a39c956a1032feb6f1ce82d286a8dcc6175f3fcc0be85a97.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 83a924b07981f194a39c956a1032feb6f1ce82d286a8dcc6175f3fcc0be85a97.exe

C:\Users\Admin\AppData\Local\Temp\83a924b07981f194a39c956a1032feb6f1ce82d286a8dcc6175f3fcc0be85a97.exe
"C:\Users\Admin\AppData\Local\Temp\83a924b07981f194a39c956a1032feb6f1ce82d286a8dcc6175f3fcc0be85a97.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-130-0x0000000000A08000-0x0000000000A69000-memory.dmp

Filesize
388KB

Download
memory/1504-131-0x0000000000D00000-0x0000000000D6B000-memory.dmp

Filesize
428KB

Download
memory/1504-133-0x0000000000400000-0x0000000000967000-memory.dmp

Filesize
5.4MB

Download
memory/1504-132-0x0000000000400000-0x0000000000967000-memory.dmp

Filesize
5.4MB

Download