Overview

overview

7

Static

static

7

DFStd.exe

windows10-1703-x64

6

DFStd.exe

windows7-x64

6

DFStd.exe

windows10-2004-x64

6

Resubmissions

28-05-2023 16:42

230528-t734eaga7y 7

28-05-2023 16:13

230528-tpb7zafe68 8

Analysis

  • max time kernel
    140s
  • max time network
    90s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-05-2023 16:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DFStd.exe

  • Size

    6.0MB

  • MD5

    b8fc2d496516ee62893881f7cd6b3519

  • SHA1

    221287ce79173679639d95722239ee449607cca1

  • SHA256

    832dbe939ca03bc4aa1c6e45d97db87871a0384b019b7cc0ca1f15492a83a9a6

  • SHA512

    12f7d501b409549c0e8ec6e38e14dac42ecc6ee9a83052ec5a3d85d1c02d5a5caba04135ae6a11987c494a924043375aee7c0b593e30cfb2ea147d98db9cc9f8

  • SSDEEP

    98304:kekrWAjN7r3ylrlOJr3ylrlODUaQWt15I/QLKENqP:KrWiN7rtrsahttLXNqP

Score
6/10
bootkitpersistence

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\DFStd.exe
    "C:\Users\Admin\AppData\Local\Temp\DFStd.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DF5ACA0.tmp\DepFrz.rdx
    Filesize

    236KB

    MD5

    168f1b0b6f87a2dba9c7cdac0e4133f2

    SHA1

    33257faedfbf477ea14298e4416b5c195e93bfb1

    SHA256

    e6dde2eeadd10dbc4ae108183e2931654927287388c3b5c12ba17019d013cea9

    SHA512

    02d40443355d91102bb7fd54b50b32bae27367464ff6d7dd01f142d936864f383a0a698aadb33f7aaca3190d793dce7cefbde30f2b3e21700907864811af1be3

    Download Submit
  • memory/2476-121-0x0000000000400000-0x0000000000736000-memory.dmp
    Filesize

    3.2MB

    Download
  • memory/2476-135-0x00000000007C0000-0x00000000007C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2476-136-0x0000000000400000-0x0000000000736000-memory.dmp
    Filesize

    3.2MB

    Download