5ecaae6a2f910bb91ce96c19fa767fc662e9d76f9549d87c43e0b876b8413743

Analysis

max time kernel
87s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ecaae6a2f910bb91ce96c19fa767fc662e9d76f9549d87c43e0b876b8413743.exe
Size

136KB
MD5

34b1bfda4b5ea776cb58b19e1afe2c30
SHA1

5ce244b27fe3b93f63f646e6d2d2bda8f74ac3a6
SHA256

5ecaae6a2f910bb91ce96c19fa767fc662e9d76f9549d87c43e0b876b8413743
SHA512

be95184ac3a8df5a04ed0689a95adcdcab7f22bdecd80ff0de058d6b45cdadd5fedafe3f8006c874bc9c0b9ee480ad8baaae33153a28c9362fd63ef1b7540a92
SSDEEP

3072:gmPjvPc+1Ts2LAbt2vqZDNzSojTDhxYL2oTObB32L:gmo+tPvqpNzSuTQLZTObB32

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\physicaldrive0	5ecaae6a2f910bb91ce96c19fa767fc662e9d76f9549d87c43e0b876b8413743.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1508	5ecaae6a2f910bb91ce96c19fa767fc662e9d76f9549d87c43e0b876b8413743.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1508	5ecaae6a2f910bb91ce96c19fa767fc662e9d76f9549d87c43e0b876b8413743.exe

C:\Users\Admin\AppData\Local\Temp\5ecaae6a2f910bb91ce96c19fa767fc662e9d76f9549d87c43e0b876b8413743.exe
"C:\Users\Admin\AppData\Local\Temp\5ecaae6a2f910bb91ce96c19fa767fc662e9d76f9549d87c43e0b876b8413743.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1508-133-0x00000000021F0000-0x00000000022F0000-memory.dmp

Filesize
1024KB

Download