Analysis

  • max time kernel
    143s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-02-2023 20:20

General

  • Target

    af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574.exe

  • Size

    1.0MB

  • MD5

    9a1c42301e0c89e0f3966830aae9db0b

  • SHA1

    88b7a78444710b4f77884d6002dfc227e3c15cf4

  • SHA256

    af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574

  • SHA512

    838a4096a8333a19cf7a74febd373c786871ab580692a10a429e76a06a6818899228bfa233612628b30f9b1f36b245afae5028d9b26990536a36240c6678ca28

  • SSDEEP

    24576:+jR9uAcA1of1RHufOqa/W77t9yo5/ST0XN2kFStzb:+jTMA1WRHFqau3/5+0XN2kFe

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574.exe
    "C:\Users\Admin\AppData\Local\Temp\af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:4580

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    521B

    MD5

    a2d88a0100f8c10f85413b5ce85f6294

    SHA1

    8dd4a428a33199744047c9d0ed6aca1c26a70c8c

    SHA256

    4afc5add02119b1a71be2887662158986bf2cf89e2b025c2c582ff1d22370380

    SHA512

    5d09802e7759e19e17a077978bf183d0d6df0abb9d86c152669f420f264edda171e886fb9255134a9ce4b2e30750ba172053d6da8057c3bdf8afb0b624a15957

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    521B

    MD5

    a2d88a0100f8c10f85413b5ce85f6294

    SHA1

    8dd4a428a33199744047c9d0ed6aca1c26a70c8c

    SHA256

    4afc5add02119b1a71be2887662158986bf2cf89e2b025c2c582ff1d22370380

    SHA512

    5d09802e7759e19e17a077978bf183d0d6df0abb9d86c152669f420f264edda171e886fb9255134a9ce4b2e30750ba172053d6da8057c3bdf8afb0b624a15957

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    1KB

    MD5

    237c86644988bfac71c4fe00f712cb04

    SHA1

    b8373a3b3c884305b8462ed6880cbb74743ce101

    SHA256

    147485077959546019640830da55e5472471c33230374656e7b5ba45452e5648

    SHA512

    9aaa62f630a137a570b4220821d4b27ef8f827378f0f8ddbe07354c9cefa79ad4e319c436142107f5225a9d3203042a79ca7376297a9a76bb7b2cbb6a5bd1c77

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    1KB

    MD5

    ae31c47dc9569a03fd457892baa0df19

    SHA1

    d15489835159a58a3d450a7d028403ea88b987ab

    SHA256

    51bf5f57ca871ec5e5f803597479264aedb3f9438644840e85b40b732f9bdfc2

    SHA512

    3bb95b5cf9c73354101504dac3ac1f6e109db7fd6f378e41df3866783efbb6dd6ae88133c62b208a79b7a249872a8c6e4db30e168d3ce7c2b2a63f76df4096fa

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    2KB

    MD5

    90a85fdff684798ce6ea66116d186450

    SHA1

    a14a6cb517d62b9a7dc81286980906a7060e7fd6

    SHA256

    7c43d6d9e33792996c7e0e44992284ca90bf9911377c1ce1f89602eba4275934

    SHA512

    cba952d6472e072fd5b20d9f055cbbfaa78eff357d2d845ecc9bd04b876a8f4486addbeca74b5bedc264575ac6b22c4e74f1f0611c00770a75b01e9cffb2841c

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    4KB

    MD5

    63ea198def6438abb1c4ee5c397d32a5

    SHA1

    19f357cd00a26079880e8f8c2e106546785452e4

    SHA256

    3b5f4b828e98a1aa3e8d62a3829f3c8c6843cade26db795d425adf37307e40b3

    SHA512

    b446013bbbddf7bbde95c7fc1b23634a5a69f2860dd517d378b3b0b9d6d2966563d6db921cc04accad292f967645000a685416be81ede6c9a92f86d00fd0b6ca

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    4KB

    MD5

    63ea198def6438abb1c4ee5c397d32a5

    SHA1

    19f357cd00a26079880e8f8c2e106546785452e4

    SHA256

    3b5f4b828e98a1aa3e8d62a3829f3c8c6843cade26db795d425adf37307e40b3

    SHA512

    b446013bbbddf7bbde95c7fc1b23634a5a69f2860dd517d378b3b0b9d6d2966563d6db921cc04accad292f967645000a685416be81ede6c9a92f86d00fd0b6ca

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    20KB

    MD5

    bd9db10c5281eca5c3c326d77470b53a

    SHA1

    d1fee9f6de0fdf3940b92d5222372c4856154257

    SHA256

    b901d24838dea8881bf99ac0b7aa4dda886db37672b5f84bfdc0eb5c0d014252

    SHA512

    ee40b276ba202ab15866630848485b33058d652c53ffa0871784e0aaebca2c447b7931b0dc5f86e25de37b2e3b13439667c1c6d44c98a2a6ed50a870860f6ca9

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    20KB

    MD5

    8c2174d17c65e7b010eedb6eaf839a90

    SHA1

    35464bd476837254a640988dca276ccb738a1806

    SHA256

    11c920a079ea5a46cc7eb54ff2c58d11f1d61269211ecc243d2afa91ba12a9db

    SHA512

    3b1808e3560de82416852c6acc6ea7daba8bcb1adfb6adb5b7426df82cf589cd827df0aae16eb51967070500fd70fbd17517777081b6caf829245db004243bc5

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    20KB

    MD5

    20b7fc4e037840fe00dd40e2e23a212e

    SHA1

    9ea0b67963ed8b3c0bb8ed9e68b47c2dfd25a688

    SHA256

    21900b424d9eaa9c65f946f0f66b4f0428e5192e6a0b4fcd81b9ac02b9cb5524

    SHA512

    3b2c8258b687b99dacb114c816b776367de640e1889b8a54fe0209427184188eca1003cb5aa04c8adedfda0497bad1167bb73e55f2951934e04ae322240cb054

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    20KB

    MD5

    4c4a66c0cb82cfa9c8e9b975ad10a781

    SHA1

    7035fa49e3518ee60f421aefbb498aade780b5bb

    SHA256

    76c0f1cb7288fcb38b04511abbecc0aeb571cbacc59244771f4d7c30a5523657

    SHA512

    0f3e74072e8bdfb0553f16dbf1dbc315b3d14bcb575bfad605d101a2868001ac882af7e70191c5e85eecdd4e4f7fe620e379015a7c0a34c4b30c8de8e3a085e0

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    21KB

    MD5

    d3cc46aa49edca0a6a33a1fb305f212c

    SHA1

    dd09bf4edd7da141a104a70f8bec2a191a9c5fc0

    SHA256

    9cd1e310742ac8a263fdfda226aab5a5dbc9e0bf44f39b899d3c13b760b4636b

    SHA512

    7d71996737f8f9c1757b547e905df88ab7f4f5c87e564886cd1815d87a4e9ae3952197dcd364b0bd7aa3bb2e5a480c671d9f13dd26e575a98efa282d281e7e1c

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    21KB

    MD5

    0cf768806c52b203c7863df87e169398

    SHA1

    1f3143fe976152435aa635efe0fa405e47006902

    SHA256

    19cb454978ef8fce1177d482a39d4580cc2d9576b6f5d047e5e168178a61d0d7

    SHA512

    7747064bd1c411b03919bb1529a67ce6fec1c8753769ac6fb4a113558b5cc29d38820e1e5a98b516b81a87f9a9765d7f08acc10369157bcb480b1afc8922032d

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    21KB

    MD5

    b17f14e8606a3e265e9636109a5129ca

    SHA1

    3bb8d86068dce8ca320b107f8e19f92f62292f60

    SHA256

    76c71c928640251e713c6c0c409db318da828b0107128bdf40ba9b3881b992bd

    SHA512

    544f3bc57cd90d7343f1f9967cf7fdd6cc117330d97a137da4daf328a563d5ed4dd2c530a34e38f23c34799543e2d7d8a536f48ddf66385804afef2a1a81930c

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    21KB

    MD5

    29e0e08e2c49a24d8c6d8fb12be112bf

    SHA1

    efb7bb876cf8c99487b865c48b875dc5fd4abb36

    SHA256

    83a76b6b67cd1c6f1f8aa8fe456fa5589eedbcc57adc640e2b65c068bbba72cc

    SHA512

    4bc2af8f08a44c8a0888f62c94eef3781d61005c9a01fd9b77cd7ccbe8650a03c0dc03494e273be4ed07984ccc4c80f467efaf6809b1d81f4fbd0f938db125e5

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    21KB

    MD5

    67fe2ca0088c140f53229ad6ecefacca

    SHA1

    01da59898b072354eead6bee76b1131b74783c1b

    SHA256

    ad1c241cbb84d6480d1e9588238f6f0b7188cfd4622eff63b5ea9557b8e23d95

    SHA512

    dba1135f05d7b9c4706aea7ea2ee09192f0655dbc44357caeb422a262319c549563578832ee8cb242bd1c53e2c480134635356f9ddf892de768903c117d41fe6

  • C:\Users\Admin\AppData\Local\Temp\!Setup.txt
    Filesize

    23KB

    MD5

    07624147b7640dd41cb7bbc0d7930a33

    SHA1

    05288eb88fc54ffdacdbc5c193969d23e768c665

    SHA256

    7b38c247ccfa1ae9585b283fd0169a00c41cf3fe190fe370172324008b455bfe

    SHA512

    ea2c4aa1cba81522ed78a60f155e249949a7f4baea4b2505eee5d5ec2b5bc56a8c593568135710945cdd19bcc25a7a748017c8d1acaf0ac7a1db40cba0a0a2ab

  • C:\Users\Admin\AppData\Local\Temp\Command.ini
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Local\Temp\Command.ini
    Filesize

    4KB

    MD5

    2e1897e9440eaee565a8729e6600daea

    SHA1

    79a01e5c1b4c4446bb76f11316d55c45fbd07aca

    SHA256

    2c4be61872472cee5795ec68b6a88b2d9ee2d1256f44869fff2ca43ca05f1d6e

    SHA512

    8fce5488ae586dd58e419889a3e4030666f85518a6347c412592ea722f60596ce93f6160a6b631706050399789e351e59a384effba4b72cdfcd6578cd85529ae

  • C:\Users\Admin\AppData\Local\Temp\Command.ini
    Filesize

    4KB

    MD5

    2e1897e9440eaee565a8729e6600daea

    SHA1

    79a01e5c1b4c4446bb76f11316d55c45fbd07aca

    SHA256

    2c4be61872472cee5795ec68b6a88b2d9ee2d1256f44869fff2ca43ca05f1d6e

    SHA512

    8fce5488ae586dd58e419889a3e4030666f85518a6347c412592ea722f60596ce93f6160a6b631706050399789e351e59a384effba4b72cdfcd6578cd85529ae

  • C:\Users\Admin\AppData\Local\Temp\Command.ini
    Filesize

    5KB

    MD5

    bb61a18a2fe7396efef499ca90a37e04

    SHA1

    152d3f2291564c7adbc0072c8198ccdfd6ca45aa

    SHA256

    5a1f40cba9c489ccd7049c38f2d8d46150bf25143d7ee8228ca9f929c1e3ab1f

    SHA512

    42b39c170159d0b371bc2c40bbd981b47f52486937031e9934c3df2a90651283bd593ba43d88f9980897f889d2f966219bcbb3594c767bf7c87a3e935f3934df

  • C:\Users\Admin\AppData\Local\Temp\Command.ini
    Filesize

    6KB

    MD5

    995b8a5fd46f50a5a9ac3151e4104aab

    SHA1

    beb7338e55e6caa5ab3c03b540d12544e176e0be

    SHA256

    f99900aa9bfb56964da7bc6b40c26eeff7a300e233b302ef1d05c724714b0ab2

    SHA512

    f523c61ad4b4597c66838a5c53334e8223a997687f86b0e8b8253854dfe06bffb0a0feb0662f76690692613971b609b41fb3d1915cecec8f115b8e642137e651

  • C:\Users\Admin\AppData\Local\Temp\Command.ini
    Filesize

    618B

    MD5

    bba4216db53def1f68a3ca2d63a6d64a

    SHA1

    92df6eec3a6a478351406c8bee2efc972d4c271f

    SHA256

    4bdbdf034def347b5f893353d48d291b1914228e423bea71959f896c05f2f4c2

    SHA512

    22f3a42388f29573376c3eb86d640755572121d97a1e574449f486e8658c445f319540aef0171223e6131d223580df5f052c7bfe4ce087a168f58ff8b8fe5499

  • C:\Users\Admin\AppData\Local\Temp\Command.ini
    Filesize

    991B

    MD5

    70afadc88c2a6aa86fa1c5bd6242ba15

    SHA1

    bc680adab122febe81b16db2de42c802dde08f55

    SHA256

    12c604de906739330d43b6a6dea79d9c139ada1b27083fa0b64e44bcf3107b41

    SHA512

    5bd96f802283381b21ff11fe63d70dc067af97269a4eae529c2878303110e9ba5839960a1da714c03b93951aadb51b4b165e261fa35bbce9ef1c146e5795e8f7

  • C:\Users\Admin\AppData\Local\Temp\Exps.ini
    Filesize

    3KB

    MD5

    c55b3c3e4fba704cf193a11545a8562b

    SHA1

    7449fe56395c31bc41c785af05cb9dd6b5f91dc7

    SHA256

    be2cd9fee864fdad986bbf21d5a19c12434e6ca9b476be5afb9ae0463eb8cf3e

    SHA512

    56ab3773b15ecf0d6bae43c79e0735a019f9e7b79fbe5aa6a4a044f2e4cc78bee82ead7e513f47a1f7c0ff4e388741600dfdbabc6b3865ce58261e2938919b88

  • C:\Users\Admin\AppData\Local\Temp\Exps.ini
    Filesize

    3KB

    MD5

    d07589726e168d81bb2873f40a7e0fc5

    SHA1

    9dc7ad7a916c44c96119dbd88a9017bc5f369342

    SHA256

    2485466ed967c08117c7c684a5943432487d3da5714c94a1cc7c30da44963c7a

    SHA512

    9c6dc6d06f8b60937f3a89135d3d1e8ce38a106f52c77e2ddffe561c9cf86e49bcd7266ef9f4194560ddc8174de6d2e62016d5cdd99c860b58f00c5f032ef027

  • C:\Users\Admin\AppData\Local\Temp\Exps.ini
    Filesize

    3KB

    MD5

    509fb292fbf7a5570b1ddb57d8b36610

    SHA1

    82406840dcd33a72d0b0caa465ac2963555c9e0e

    SHA256

    b087da22c7846b650f87187edcc961dcf9e55e2b6c6a745e854e1224fc6d6c26

    SHA512

    8ac06e93a28b5655a305900f44a06bc1c136e1894a5420b53c717e938fe30619832180488d0ac2459303dec66042d38b51427361724e7e44d65382145b07ea6c

  • C:\Users\Admin\AppData\Local\Temp\Exps.ini
    Filesize

    3KB

    MD5

    b5ac9955e55a56f0734e77670b510d54

    SHA1

    c49c0308938fb9b8a4bfe7c6f9100438c739aa64

    SHA256

    b13406f444cd64299c19963882424889f3083d617a256647443adb1101f2f709

    SHA512

    e3e3c35fce049ae960e0ddee5da559f9979ab379585ac79677b562a0ec852c69959ae3e7578c26db838bd0fc05d2388115cc54aa3f62cd22f68859445c709039

  • C:\Users\Admin\AppData\Local\Temp\Exps.ini
    Filesize

    4KB

    MD5

    5233a08bf7278b9b349bb318e1e37133

    SHA1

    5b16cf905fd8bc4ce7d620dd8d0fc431dbb78228

    SHA256

    0baac23f939d41f8a7c6aca9e062575c538b79d037b981ab02edcbf5ec09a25f

    SHA512

    853e8225f0791d794c47661312546ed73a1102a06538d129089de8d45879f848d27388ef3a61ac5f01baee11ce5e7786d9f0b9a3fda2128301c71fe4435de5e0

  • C:\Users\Admin\AppData\Local\Temp\String.ini
    Filesize

    1KB

    MD5

    28532e73db64841f969c44b8ea3bd745

    SHA1

    5df917430b1e2213bb60b69f7d8a5a6ea3f508d8

    SHA256

    148fcb210957054a042acd7e41d435e712b6268e8bf4d4a959cb2feb6760a49e

    SHA512

    fe9cf28e20d6910812723b151ed685bb303f6e7e188b5d328d3311df715b42ef50e59f9a6428dbbf16cffb4519b37f688d0556f1cb18eddca06014641405894e

  • C:\Users\Admin\AppData\Local\Temp\String.ini
    Filesize

    1KB

    MD5

    28532e73db64841f969c44b8ea3bd745

    SHA1

    5df917430b1e2213bb60b69f7d8a5a6ea3f508d8

    SHA256

    148fcb210957054a042acd7e41d435e712b6268e8bf4d4a959cb2feb6760a49e

    SHA512

    fe9cf28e20d6910812723b151ed685bb303f6e7e188b5d328d3311df715b42ef50e59f9a6428dbbf16cffb4519b37f688d0556f1cb18eddca06014641405894e

  • C:\Users\Admin\AppData\Local\Temp\String.ini
    Filesize

    1KB

    MD5

    28532e73db64841f969c44b8ea3bd745

    SHA1

    5df917430b1e2213bb60b69f7d8a5a6ea3f508d8

    SHA256

    148fcb210957054a042acd7e41d435e712b6268e8bf4d4a959cb2feb6760a49e

    SHA512

    fe9cf28e20d6910812723b151ed685bb303f6e7e188b5d328d3311df715b42ef50e59f9a6428dbbf16cffb4519b37f688d0556f1cb18eddca06014641405894e

  • C:\Users\Admin\AppData\Local\Temp\String.ini
    Filesize

    1KB

    MD5

    245374422652b38fe21506d17daaf56f

    SHA1

    53774549da4dc56578b5ab37be09d2207ddf52f1

    SHA256

    a29184158f1a5c96c91be26f3d88f772aa3cdf2d469deef82bfe312918b9e7f5

    SHA512

    ff8b6e9badc2e145120e3658a3df77c7603f38cafcdeb8c771bf3f8e9c4ef6dca9797201382b264f719d868324827b7935be2acd3e94d0fcd29533728155cd8f

  • C:\Users\Admin\AppData\Local\Temp\String.ini
    Filesize

    4KB

    MD5

    c159e79c981519e7c415e98206b0d186

    SHA1

    58aa61a40a681760cffd8231a280f58ecc31774e

    SHA256

    bc7399748a01be37b52f97cb98a74423983fa780330a730ed4f209d76d82a000

    SHA512

    efb3c8351f41b4e482dbadc529202f1aa078fd69d57b363dd6d4d3717598fdcdeb491a47b292abf80286010b10edad0505ce66547ab2fa6cb44c440b9be79019

  • C:\Users\Admin\AppData\Local\Temp\String.ini
    Filesize

    4KB

    MD5

    0a2fbcff9381a4b8c29dfc34d4413439

    SHA1

    39eaa2e806c279eebe12555640220f40540c980e

    SHA256

    60aa51eabfcfee8370cd65b4383a3ce49175147eea914c524e1dfb0f2d8c364f

    SHA512

    ddba410f648b16bfcef15b8b65bd8844a21630cc0d018c296c921832fca030edb54c3fcede4e50c7ed19abe7c974bebbf466741a26efc0648487da1f9cf85d35

  • memory/4580-8875-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-133-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8826-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8827-0x0000000002510000-0x0000000002511000-memory.dmp
    Filesize

    4KB

  • memory/4580-8839-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8863-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-134-0x0000000002510000-0x0000000002511000-memory.dmp
    Filesize

    4KB

  • memory/4580-8887-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8899-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8911-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8923-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8935-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8947-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8959-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8971-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB

  • memory/4580-8983-0x0000000000400000-0x000000000079E000-memory.dmp
    Filesize

    3.6MB