5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc

General

Target

5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Size

3.0MB
MD5

9eb07aa2a45e1126a6e3625fe30174ea
SHA1

06a9d377db69a0ad001781ade18d5c93f2365344
SHA256

5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc
SHA512

7df32da2e97b40656a2832c0e0fede46da533bacefc3822c22d4ca6c1e84304a5779cd6724115722915cbcd588134252cc9df191deb37dfb020466b03654e29a
SSDEEP

49152:c8ep2+XDhj2hKdu1SRuX6VFm7N++3HqXz2gTf1iwyJPw5j32Zw59k:cJ2+Xd6ME625yD8xBC3249k

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe

description ioc process

File opened for modification \??\PhysicalDrive0 5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe

pid	process
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe

description	pid	process
Token: 33	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeIncBasePriorityPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: 33	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeIncBasePriorityPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: 33	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeIncBasePriorityPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
Token: SeDebugPrivilege	1912	5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe

C:\Users\Admin\AppData\Local\Temp\5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe
"C:\Users\Admin\AppData\Local\Temp\5d8fb9305db4ea8451b81d045c80c56489bcf43ecea4b6c7904cc98f0e5080bc.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1912-55-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1912-57-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1912-56-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1912-58-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/1912-61-0x00000000003E3000-0x00000000003E7000-memory.dmp

Filesize
16KB

Download
memory/1912-69-0x00000000003EB000-0x00000000003F0000-memory.dmp

Filesize
20KB

Download
memory/1912-68-0x00000000003EB000-0x00000000003F0000-memory.dmp

Filesize
20KB

Download
memory/1912-67-0x00000000003EB000-0x00000000003F0000-memory.dmp

Filesize
20KB

Download
memory/1912-66-0x00000000003EB000-0x00000000003F0000-memory.dmp

Filesize
20KB

Download
memory/1912-65-0x00000000003EB000-0x00000000003F0000-memory.dmp

Filesize
20KB

Download
memory/1912-70-0x00000000003EB000-0x00000000003F0000-memory.dmp

Filesize
20KB

Download
memory/1912-71-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing