6b5b6809c1512620b71383a74e11dbcb33c0fd7710ad3639a2416842576f4719

Analysis

max time kernel
152s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 15:52

Target

6b5b6809c1512620b71383a74e11dbcb33c0fd7710ad3639a2416842576f4719.exe
Size

1.6MB
MD5

efdfa2cf32dc73ba74818e022a86e39f
SHA1

e3897a60efc7d9162009fe3e45e7a403ad81915f
SHA256

6b5b6809c1512620b71383a74e11dbcb33c0fd7710ad3639a2416842576f4719
SHA512

38995b6ca172bc22aad642e5e7191335aa4a33490869f9e324208c456c69db1482925e361d6bfdc118058dd5413087986de4466ccb326c95cecb793b26983bb8
SSDEEP

24576:JhSIFQ5jJCNThZcK1KM0ZqevQOa8qYO7A56JHQWtLNAvRck9LFW4UQvhWSai2+k2:Jh0dIZpsSevQOmo2AZck9/Qd4evkNn9

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

6b5b6809c1512620b71383a74e11dbcb33c0fd7710ad3639a2416842576f4719.exe

description ioc process

File opened for modification \??\PhysicalDrive0 6b5b6809c1512620b71383a74e11dbcb33c0fd7710ad3639a2416842576f4719.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	6b5b6809c1512620b71383a74e11dbcb33c0fd7710ad3639a2416842576f4719.exe

C:\Users\Admin\AppData\Local\Temp\6b5b6809c1512620b71383a74e11dbcb33c0fd7710ad3639a2416842576f4719.exe
"C:\Users\Admin\AppData\Local\Temp\6b5b6809c1512620b71383a74e11dbcb33c0fd7710ad3639a2416842576f4719.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:4012

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact