0643ef71288bde5c2d85051dd523012082166f202cb2c793fbbb3ee1619b5ba8

Analysis

max time kernel
85s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 07:51

Target

0643ef71288bde5c2d85051dd523012082166f202cb2c793fbbb3ee1619b5ba8.exe
Size

210KB
MD5

317611559486942618192414f0e2d812
SHA1

06e09efd00deb86113eea9266d91b2c81404a120
SHA256

0643ef71288bde5c2d85051dd523012082166f202cb2c793fbbb3ee1619b5ba8
SHA512

252bf922e93c0a0e02aefe7ddab208420ae16605b632955372c22b2c784679e6217888856006e30214aa385ce13a38e648b35b34f4bac7f133571f38baf9d61e
SSDEEP

3072:jVMDRLFHko2q3dF/pstBaDqwONnct437Bl3N2U+jZwMd:5MDNFEm3dF/p/uwONct43j92U+l

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

0643ef71288bde5c2d85051dd523012082166f202cb2c793fbbb3ee1619b5ba8.exe

description ioc process

File opened for modification \??\PhysicalDrive0 0643ef71288bde5c2d85051dd523012082166f202cb2c793fbbb3ee1619b5ba8.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	0643ef71288bde5c2d85051dd523012082166f202cb2c793fbbb3ee1619b5ba8.exe

C:\Users\Admin\AppData\Local\Temp\0643ef71288bde5c2d85051dd523012082166f202cb2c793fbbb3ee1619b5ba8.exe
"C:\Users\Admin\AppData\Local\Temp\0643ef71288bde5c2d85051dd523012082166f202cb2c793fbbb3ee1619b5ba8.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:432

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact