ad2e573de3e4c9409cb16273abcb4251ce5a4462bdd0354ea5cb583ddb4bb820

Analysis

max time kernel
167s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad2e573de3e4c9409cb16273abcb4251ce5a4462bdd0354ea5cb583ddb4bb820.exe
Size

126KB
MD5

2224604207e56d902298dfe6cc3bd360
SHA1

e489d28d634275a41441790eb815fb189e8d6cce
SHA256

ad2e573de3e4c9409cb16273abcb4251ce5a4462bdd0354ea5cb583ddb4bb820
SHA512

b996c21313f169f6ac103cf6b40051b4cc971da62142a8577b54f020325897f27e02d8d5ed9a3f8c96d5adcfd4839c91a5523e0ba3dbc69c0557adb24cd78a32
SSDEEP

3072:kcFZ0hEBiwlllLoAVxQnQn1S4tz6VfSrVHF2j+3x+j:kyBBiwlll/xQnQnzxrpgjTj

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\physicaldrive0	ad2e573de3e4c9409cb16273abcb4251ce5a4462bdd0354ea5cb583ddb4bb820.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
216	ad2e573de3e4c9409cb16273abcb4251ce5a4462bdd0354ea5cb583ddb4bb820.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	216	ad2e573de3e4c9409cb16273abcb4251ce5a4462bdd0354ea5cb583ddb4bb820.exe

C:\Users\Admin\AppData\Local\Temp\ad2e573de3e4c9409cb16273abcb4251ce5a4462bdd0354ea5cb583ddb4bb820.exe
"C:\Users\Admin\AppData\Local\Temp\ad2e573de3e4c9409cb16273abcb4251ce5a4462bdd0354ea5cb583ddb4bb820.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-132-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/216-133-0x0000000002070000-0x0000000002170000-memory.dmp

Filesize
1024KB

Download