e9ca77c0b4c579cc509b18576c156c9ed0b4ff7a47d315a42eaa18620ca74a74

Analysis

max time kernel
96s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9ca77c0b4c579cc509b18576c156c9ed0b4ff7a47d315a42eaa18620ca74a74.exe
Size

166KB
MD5

5e96f77a499ba7a471216fe64fc30f4a
SHA1

8213a4f39fd2453ecb3e417025e435cd760e5ecb
SHA256

e9ca77c0b4c579cc509b18576c156c9ed0b4ff7a47d315a42eaa18620ca74a74
SHA512

21090b77cab9fdfc82ebf78192809c6b836a9d7b038c52fc78ff1a91582a8c4e24acfee52efa8daf7996b0e4fee8ef0df8af423dcf74a802b229d32f806b43bf
SSDEEP

3072:/1TUU41gG5KV76Pv1Vk76KQAfFf2inw02PIfi8MHM+jqC2x:tTUU41gz761irQNinwJyi8MHM26

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\physicaldrive0	e9ca77c0b4c579cc509b18576c156c9ed0b4ff7a47d315a42eaa18620ca74a74.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1364	e9ca77c0b4c579cc509b18576c156c9ed0b4ff7a47d315a42eaa18620ca74a74.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1364	e9ca77c0b4c579cc509b18576c156c9ed0b4ff7a47d315a42eaa18620ca74a74.exe

C:\Users\Admin\AppData\Local\Temp\e9ca77c0b4c579cc509b18576c156c9ed0b4ff7a47d315a42eaa18620ca74a74.exe
"C:\Users\Admin\AppData\Local\Temp\e9ca77c0b4c579cc509b18576c156c9ed0b4ff7a47d315a42eaa18620ca74a74.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-133-0x0000000002180000-0x00000000021C2000-memory.dmp

Filesize
264KB

Download
memory/1364-132-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1364-134-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download