2bc22113ef4e266f6378900a6a607ce675f435bfc871c2e6110cc6ea81726d21

Analysis

max time kernel
149s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 04:42

Target

2bc22113ef4e266f6378900a6a607ce675f435bfc871c2e6110cc6ea81726d21.exe
Size

112KB
MD5

0f7a3ab6bd0e348690b8129e905a8154
SHA1

49f29cbb44f3afe0826acb6b0b09d56649189c44
SHA256

2bc22113ef4e266f6378900a6a607ce675f435bfc871c2e6110cc6ea81726d21
SHA512

9d7fb38d69b4c870574ae9a19c28da1d0df750a9d1f90691d8bcb5950d3a0d5c912fa2dbd47ef79c07aae1997c14cc7651c800c719bd0599de2b7e0fe359b5e7
SSDEEP

1536:ZF38FYSUb8o83ygYmQouMMIuXK7b3FMGu0/gCfEz775FfWJZtICS4AaWJ1f+tJf5:b8FG+1YmQoYkbWfIug8f+tJx

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

2bc22113ef4e266f6378900a6a607ce675f435bfc871c2e6110cc6ea81726d21.exe

description ioc process

File opened for modification \??\PhysicalDrive0 2bc22113ef4e266f6378900a6a607ce675f435bfc871c2e6110cc6ea81726d21.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	2bc22113ef4e266f6378900a6a607ce675f435bfc871c2e6110cc6ea81726d21.exe

C:\Users\Admin\AppData\Local\Temp\2bc22113ef4e266f6378900a6a607ce675f435bfc871c2e6110cc6ea81726d21.exe
"C:\Users\Admin\AppData\Local\Temp\2bc22113ef4e266f6378900a6a607ce675f435bfc871c2e6110cc6ea81726d21.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:1424

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact