Overview

overview

6

Static

static

BootData.zip

windows10-2004-x64

6

Analysis

  • max time kernel
    608s
  • max time network
    549s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-12-2022 03:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BootData.zip

  • Size

    7KB

  • MD5

    01a17ef4a11822b1103d7344fe867a69

  • SHA1

    06e110effa508a2091702e53ecbcd4f53b1d9544

  • SHA256

    a1d0f00b80078c53301ace3c7acd93cf7d1e44a4f99b4dbc8661bdc43c28266d

  • SHA512

    2fd72a8fb537e6fb847d90207313f2fa63ed3242372cdf68cdffd847e9e19af41d442300e0fd681391b39c4020b2c8ad4fa4b4c309e6e5ac66df7be8555c1317

  • SSDEEP

    192:mQumgIyVGoe7vOplqPLTRxgAd09ghnRMOVjpT:migvQh7sqDT3HVHF

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\BootData.zip
    1⤵
      PID:5068
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3148
      • C:\Users\Admin\Documents\BootData\bootdata.exe
        "C:\Users\Admin\Documents\BootData\bootdata.exe"
        1⤵
        • Writes to the Master Boot Record (MBR)
        PID:2324
      • C:\Users\Admin\Documents\BootData\bootdata.exe
        "C:\Users\Admin\Documents\BootData\bootdata.exe"
        1⤵
        • Writes to the Master Boot Record (MBR)
        PID:2476
      • C:\Users\Admin\Documents\BootData\bootdata.exe
        "C:\Users\Admin\Documents\BootData\bootdata.exe"
        1⤵
        • Writes to the Master Boot Record (MBR)
        PID:5072

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Bootkit

      1
      T1067

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2324-132-0x0000000000400000-0x000000000040A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/2476-133-0x0000000000400000-0x000000000040A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/5072-134-0x0000000000400000-0x000000000040A000-memory.dmp
        Filesize

        40KB

        Download