Analysis
-
max time kernel
143s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2023 20:20
Behavioral task
behavioral1
Sample
af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574.exe
Resource
win10v2004-20230220-en
General
-
Target
af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574.exe
-
Size
1.0MB
-
MD5
9a1c42301e0c89e0f3966830aae9db0b
-
SHA1
88b7a78444710b4f77884d6002dfc227e3c15cf4
-
SHA256
af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574
-
SHA512
838a4096a8333a19cf7a74febd373c786871ab580692a10a429e76a06a6818899228bfa233612628b30f9b1f36b245afae5028d9b26990536a36240c6678ca28
-
SSDEEP
24576:+jR9uAcA1of1RHufOqa/W77t9yo5/ST0XN2kFStzb:+jTMA1WRHFqau3/5+0XN2kFe
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574.exedescription ioc process File opened for modification \??\PhysicalDrive0 af60bbdd48bc29c860fd9b69bb9a84a497320c0209a47cb470698e3f3bfa6574.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
521B
MD5a2d88a0100f8c10f85413b5ce85f6294
SHA18dd4a428a33199744047c9d0ed6aca1c26a70c8c
SHA2564afc5add02119b1a71be2887662158986bf2cf89e2b025c2c582ff1d22370380
SHA5125d09802e7759e19e17a077978bf183d0d6df0abb9d86c152669f420f264edda171e886fb9255134a9ce4b2e30750ba172053d6da8057c3bdf8afb0b624a15957
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
521B
MD5a2d88a0100f8c10f85413b5ce85f6294
SHA18dd4a428a33199744047c9d0ed6aca1c26a70c8c
SHA2564afc5add02119b1a71be2887662158986bf2cf89e2b025c2c582ff1d22370380
SHA5125d09802e7759e19e17a077978bf183d0d6df0abb9d86c152669f420f264edda171e886fb9255134a9ce4b2e30750ba172053d6da8057c3bdf8afb0b624a15957
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
1KB
MD5237c86644988bfac71c4fe00f712cb04
SHA1b8373a3b3c884305b8462ed6880cbb74743ce101
SHA256147485077959546019640830da55e5472471c33230374656e7b5ba45452e5648
SHA5129aaa62f630a137a570b4220821d4b27ef8f827378f0f8ddbe07354c9cefa79ad4e319c436142107f5225a9d3203042a79ca7376297a9a76bb7b2cbb6a5bd1c77
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
1KB
MD5ae31c47dc9569a03fd457892baa0df19
SHA1d15489835159a58a3d450a7d028403ea88b987ab
SHA25651bf5f57ca871ec5e5f803597479264aedb3f9438644840e85b40b732f9bdfc2
SHA5123bb95b5cf9c73354101504dac3ac1f6e109db7fd6f378e41df3866783efbb6dd6ae88133c62b208a79b7a249872a8c6e4db30e168d3ce7c2b2a63f76df4096fa
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
2KB
MD590a85fdff684798ce6ea66116d186450
SHA1a14a6cb517d62b9a7dc81286980906a7060e7fd6
SHA2567c43d6d9e33792996c7e0e44992284ca90bf9911377c1ce1f89602eba4275934
SHA512cba952d6472e072fd5b20d9f055cbbfaa78eff357d2d845ecc9bd04b876a8f4486addbeca74b5bedc264575ac6b22c4e74f1f0611c00770a75b01e9cffb2841c
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
4KB
MD563ea198def6438abb1c4ee5c397d32a5
SHA119f357cd00a26079880e8f8c2e106546785452e4
SHA2563b5f4b828e98a1aa3e8d62a3829f3c8c6843cade26db795d425adf37307e40b3
SHA512b446013bbbddf7bbde95c7fc1b23634a5a69f2860dd517d378b3b0b9d6d2966563d6db921cc04accad292f967645000a685416be81ede6c9a92f86d00fd0b6ca
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
4KB
MD563ea198def6438abb1c4ee5c397d32a5
SHA119f357cd00a26079880e8f8c2e106546785452e4
SHA2563b5f4b828e98a1aa3e8d62a3829f3c8c6843cade26db795d425adf37307e40b3
SHA512b446013bbbddf7bbde95c7fc1b23634a5a69f2860dd517d378b3b0b9d6d2966563d6db921cc04accad292f967645000a685416be81ede6c9a92f86d00fd0b6ca
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
20KB
MD5bd9db10c5281eca5c3c326d77470b53a
SHA1d1fee9f6de0fdf3940b92d5222372c4856154257
SHA256b901d24838dea8881bf99ac0b7aa4dda886db37672b5f84bfdc0eb5c0d014252
SHA512ee40b276ba202ab15866630848485b33058d652c53ffa0871784e0aaebca2c447b7931b0dc5f86e25de37b2e3b13439667c1c6d44c98a2a6ed50a870860f6ca9
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
20KB
MD58c2174d17c65e7b010eedb6eaf839a90
SHA135464bd476837254a640988dca276ccb738a1806
SHA25611c920a079ea5a46cc7eb54ff2c58d11f1d61269211ecc243d2afa91ba12a9db
SHA5123b1808e3560de82416852c6acc6ea7daba8bcb1adfb6adb5b7426df82cf589cd827df0aae16eb51967070500fd70fbd17517777081b6caf829245db004243bc5
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
20KB
MD520b7fc4e037840fe00dd40e2e23a212e
SHA19ea0b67963ed8b3c0bb8ed9e68b47c2dfd25a688
SHA25621900b424d9eaa9c65f946f0f66b4f0428e5192e6a0b4fcd81b9ac02b9cb5524
SHA5123b2c8258b687b99dacb114c816b776367de640e1889b8a54fe0209427184188eca1003cb5aa04c8adedfda0497bad1167bb73e55f2951934e04ae322240cb054
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
20KB
MD54c4a66c0cb82cfa9c8e9b975ad10a781
SHA17035fa49e3518ee60f421aefbb498aade780b5bb
SHA25676c0f1cb7288fcb38b04511abbecc0aeb571cbacc59244771f4d7c30a5523657
SHA5120f3e74072e8bdfb0553f16dbf1dbc315b3d14bcb575bfad605d101a2868001ac882af7e70191c5e85eecdd4e4f7fe620e379015a7c0a34c4b30c8de8e3a085e0
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
21KB
MD5d3cc46aa49edca0a6a33a1fb305f212c
SHA1dd09bf4edd7da141a104a70f8bec2a191a9c5fc0
SHA2569cd1e310742ac8a263fdfda226aab5a5dbc9e0bf44f39b899d3c13b760b4636b
SHA5127d71996737f8f9c1757b547e905df88ab7f4f5c87e564886cd1815d87a4e9ae3952197dcd364b0bd7aa3bb2e5a480c671d9f13dd26e575a98efa282d281e7e1c
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
21KB
MD50cf768806c52b203c7863df87e169398
SHA11f3143fe976152435aa635efe0fa405e47006902
SHA25619cb454978ef8fce1177d482a39d4580cc2d9576b6f5d047e5e168178a61d0d7
SHA5127747064bd1c411b03919bb1529a67ce6fec1c8753769ac6fb4a113558b5cc29d38820e1e5a98b516b81a87f9a9765d7f08acc10369157bcb480b1afc8922032d
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
21KB
MD5b17f14e8606a3e265e9636109a5129ca
SHA13bb8d86068dce8ca320b107f8e19f92f62292f60
SHA25676c71c928640251e713c6c0c409db318da828b0107128bdf40ba9b3881b992bd
SHA512544f3bc57cd90d7343f1f9967cf7fdd6cc117330d97a137da4daf328a563d5ed4dd2c530a34e38f23c34799543e2d7d8a536f48ddf66385804afef2a1a81930c
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
21KB
MD529e0e08e2c49a24d8c6d8fb12be112bf
SHA1efb7bb876cf8c99487b865c48b875dc5fd4abb36
SHA25683a76b6b67cd1c6f1f8aa8fe456fa5589eedbcc57adc640e2b65c068bbba72cc
SHA5124bc2af8f08a44c8a0888f62c94eef3781d61005c9a01fd9b77cd7ccbe8650a03c0dc03494e273be4ed07984ccc4c80f467efaf6809b1d81f4fbd0f938db125e5
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
21KB
MD567fe2ca0088c140f53229ad6ecefacca
SHA101da59898b072354eead6bee76b1131b74783c1b
SHA256ad1c241cbb84d6480d1e9588238f6f0b7188cfd4622eff63b5ea9557b8e23d95
SHA512dba1135f05d7b9c4706aea7ea2ee09192f0655dbc44357caeb422a262319c549563578832ee8cb242bd1c53e2c480134635356f9ddf892de768903c117d41fe6
-
C:\Users\Admin\AppData\Local\Temp\!Setup.txtFilesize
23KB
MD507624147b7640dd41cb7bbc0d7930a33
SHA105288eb88fc54ffdacdbc5c193969d23e768c665
SHA2567b38c247ccfa1ae9585b283fd0169a00c41cf3fe190fe370172324008b455bfe
SHA512ea2c4aa1cba81522ed78a60f155e249949a7f4baea4b2505eee5d5ec2b5bc56a8c593568135710945cdd19bcc25a7a748017c8d1acaf0ac7a1db40cba0a0a2ab
-
C:\Users\Admin\AppData\Local\Temp\Command.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\Command.iniFilesize
4KB
MD52e1897e9440eaee565a8729e6600daea
SHA179a01e5c1b4c4446bb76f11316d55c45fbd07aca
SHA2562c4be61872472cee5795ec68b6a88b2d9ee2d1256f44869fff2ca43ca05f1d6e
SHA5128fce5488ae586dd58e419889a3e4030666f85518a6347c412592ea722f60596ce93f6160a6b631706050399789e351e59a384effba4b72cdfcd6578cd85529ae
-
C:\Users\Admin\AppData\Local\Temp\Command.iniFilesize
4KB
MD52e1897e9440eaee565a8729e6600daea
SHA179a01e5c1b4c4446bb76f11316d55c45fbd07aca
SHA2562c4be61872472cee5795ec68b6a88b2d9ee2d1256f44869fff2ca43ca05f1d6e
SHA5128fce5488ae586dd58e419889a3e4030666f85518a6347c412592ea722f60596ce93f6160a6b631706050399789e351e59a384effba4b72cdfcd6578cd85529ae
-
C:\Users\Admin\AppData\Local\Temp\Command.iniFilesize
5KB
MD5bb61a18a2fe7396efef499ca90a37e04
SHA1152d3f2291564c7adbc0072c8198ccdfd6ca45aa
SHA2565a1f40cba9c489ccd7049c38f2d8d46150bf25143d7ee8228ca9f929c1e3ab1f
SHA51242b39c170159d0b371bc2c40bbd981b47f52486937031e9934c3df2a90651283bd593ba43d88f9980897f889d2f966219bcbb3594c767bf7c87a3e935f3934df
-
C:\Users\Admin\AppData\Local\Temp\Command.iniFilesize
6KB
MD5995b8a5fd46f50a5a9ac3151e4104aab
SHA1beb7338e55e6caa5ab3c03b540d12544e176e0be
SHA256f99900aa9bfb56964da7bc6b40c26eeff7a300e233b302ef1d05c724714b0ab2
SHA512f523c61ad4b4597c66838a5c53334e8223a997687f86b0e8b8253854dfe06bffb0a0feb0662f76690692613971b609b41fb3d1915cecec8f115b8e642137e651
-
C:\Users\Admin\AppData\Local\Temp\Command.iniFilesize
618B
MD5bba4216db53def1f68a3ca2d63a6d64a
SHA192df6eec3a6a478351406c8bee2efc972d4c271f
SHA2564bdbdf034def347b5f893353d48d291b1914228e423bea71959f896c05f2f4c2
SHA51222f3a42388f29573376c3eb86d640755572121d97a1e574449f486e8658c445f319540aef0171223e6131d223580df5f052c7bfe4ce087a168f58ff8b8fe5499
-
C:\Users\Admin\AppData\Local\Temp\Command.iniFilesize
991B
MD570afadc88c2a6aa86fa1c5bd6242ba15
SHA1bc680adab122febe81b16db2de42c802dde08f55
SHA25612c604de906739330d43b6a6dea79d9c139ada1b27083fa0b64e44bcf3107b41
SHA5125bd96f802283381b21ff11fe63d70dc067af97269a4eae529c2878303110e9ba5839960a1da714c03b93951aadb51b4b165e261fa35bbce9ef1c146e5795e8f7
-
C:\Users\Admin\AppData\Local\Temp\Exps.iniFilesize
3KB
MD5c55b3c3e4fba704cf193a11545a8562b
SHA17449fe56395c31bc41c785af05cb9dd6b5f91dc7
SHA256be2cd9fee864fdad986bbf21d5a19c12434e6ca9b476be5afb9ae0463eb8cf3e
SHA51256ab3773b15ecf0d6bae43c79e0735a019f9e7b79fbe5aa6a4a044f2e4cc78bee82ead7e513f47a1f7c0ff4e388741600dfdbabc6b3865ce58261e2938919b88
-
C:\Users\Admin\AppData\Local\Temp\Exps.iniFilesize
3KB
MD5d07589726e168d81bb2873f40a7e0fc5
SHA19dc7ad7a916c44c96119dbd88a9017bc5f369342
SHA2562485466ed967c08117c7c684a5943432487d3da5714c94a1cc7c30da44963c7a
SHA5129c6dc6d06f8b60937f3a89135d3d1e8ce38a106f52c77e2ddffe561c9cf86e49bcd7266ef9f4194560ddc8174de6d2e62016d5cdd99c860b58f00c5f032ef027
-
C:\Users\Admin\AppData\Local\Temp\Exps.iniFilesize
3KB
MD5509fb292fbf7a5570b1ddb57d8b36610
SHA182406840dcd33a72d0b0caa465ac2963555c9e0e
SHA256b087da22c7846b650f87187edcc961dcf9e55e2b6c6a745e854e1224fc6d6c26
SHA5128ac06e93a28b5655a305900f44a06bc1c136e1894a5420b53c717e938fe30619832180488d0ac2459303dec66042d38b51427361724e7e44d65382145b07ea6c
-
C:\Users\Admin\AppData\Local\Temp\Exps.iniFilesize
3KB
MD5b5ac9955e55a56f0734e77670b510d54
SHA1c49c0308938fb9b8a4bfe7c6f9100438c739aa64
SHA256b13406f444cd64299c19963882424889f3083d617a256647443adb1101f2f709
SHA512e3e3c35fce049ae960e0ddee5da559f9979ab379585ac79677b562a0ec852c69959ae3e7578c26db838bd0fc05d2388115cc54aa3f62cd22f68859445c709039
-
C:\Users\Admin\AppData\Local\Temp\Exps.iniFilesize
4KB
MD55233a08bf7278b9b349bb318e1e37133
SHA15b16cf905fd8bc4ce7d620dd8d0fc431dbb78228
SHA2560baac23f939d41f8a7c6aca9e062575c538b79d037b981ab02edcbf5ec09a25f
SHA512853e8225f0791d794c47661312546ed73a1102a06538d129089de8d45879f848d27388ef3a61ac5f01baee11ce5e7786d9f0b9a3fda2128301c71fe4435de5e0
-
C:\Users\Admin\AppData\Local\Temp\String.iniFilesize
1KB
MD528532e73db64841f969c44b8ea3bd745
SHA15df917430b1e2213bb60b69f7d8a5a6ea3f508d8
SHA256148fcb210957054a042acd7e41d435e712b6268e8bf4d4a959cb2feb6760a49e
SHA512fe9cf28e20d6910812723b151ed685bb303f6e7e188b5d328d3311df715b42ef50e59f9a6428dbbf16cffb4519b37f688d0556f1cb18eddca06014641405894e
-
C:\Users\Admin\AppData\Local\Temp\String.iniFilesize
1KB
MD528532e73db64841f969c44b8ea3bd745
SHA15df917430b1e2213bb60b69f7d8a5a6ea3f508d8
SHA256148fcb210957054a042acd7e41d435e712b6268e8bf4d4a959cb2feb6760a49e
SHA512fe9cf28e20d6910812723b151ed685bb303f6e7e188b5d328d3311df715b42ef50e59f9a6428dbbf16cffb4519b37f688d0556f1cb18eddca06014641405894e
-
C:\Users\Admin\AppData\Local\Temp\String.iniFilesize
1KB
MD528532e73db64841f969c44b8ea3bd745
SHA15df917430b1e2213bb60b69f7d8a5a6ea3f508d8
SHA256148fcb210957054a042acd7e41d435e712b6268e8bf4d4a959cb2feb6760a49e
SHA512fe9cf28e20d6910812723b151ed685bb303f6e7e188b5d328d3311df715b42ef50e59f9a6428dbbf16cffb4519b37f688d0556f1cb18eddca06014641405894e
-
C:\Users\Admin\AppData\Local\Temp\String.iniFilesize
1KB
MD5245374422652b38fe21506d17daaf56f
SHA153774549da4dc56578b5ab37be09d2207ddf52f1
SHA256a29184158f1a5c96c91be26f3d88f772aa3cdf2d469deef82bfe312918b9e7f5
SHA512ff8b6e9badc2e145120e3658a3df77c7603f38cafcdeb8c771bf3f8e9c4ef6dca9797201382b264f719d868324827b7935be2acd3e94d0fcd29533728155cd8f
-
C:\Users\Admin\AppData\Local\Temp\String.iniFilesize
4KB
MD5c159e79c981519e7c415e98206b0d186
SHA158aa61a40a681760cffd8231a280f58ecc31774e
SHA256bc7399748a01be37b52f97cb98a74423983fa780330a730ed4f209d76d82a000
SHA512efb3c8351f41b4e482dbadc529202f1aa078fd69d57b363dd6d4d3717598fdcdeb491a47b292abf80286010b10edad0505ce66547ab2fa6cb44c440b9be79019
-
C:\Users\Admin\AppData\Local\Temp\String.iniFilesize
4KB
MD50a2fbcff9381a4b8c29dfc34d4413439
SHA139eaa2e806c279eebe12555640220f40540c980e
SHA25660aa51eabfcfee8370cd65b4383a3ce49175147eea914c524e1dfb0f2d8c364f
SHA512ddba410f648b16bfcef15b8b65bd8844a21630cc0d018c296c921832fca030edb54c3fcede4e50c7ed19abe7c974bebbf466741a26efc0648487da1f9cf85d35
-
memory/4580-8875-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-133-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8826-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8827-0x0000000002510000-0x0000000002511000-memory.dmpFilesize
4KB
-
memory/4580-8839-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8863-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-134-0x0000000002510000-0x0000000002511000-memory.dmpFilesize
4KB
-
memory/4580-8887-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8899-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8911-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8923-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8935-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8947-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8959-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8971-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4580-8983-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB