Analysis
-
max time kernel
124s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
08-11-2023 03:15
General
-
Target
Bootkits/6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286.exe
-
Size
83KB
-
MD5
64e1aa6f5dca669ba51678157058d54b
-
SHA1
9f6df0a011748160b0c18fb2b44ebe9fa9d517e9
-
SHA256
6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286
-
SHA512
91f5cc1aba9b26a16e7b9e082c2982f71fe9996be9072f0252a2864894904fec57b65b6d1dae98274df2fe3e4ab4626364040e16802fa5ccf152b71228b54c0d
-
SSDEEP
1536:esDWvcIU3ayXD1D12E5G9JR0+iGxxUWfdOzq3bdPOoH6LBqtgkdd+4MxUAsKliwZ:WeayXIJR0hGvTfMwfaLBViYUAzF
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootkits\6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286.exe"C:\Users\Admin\AppData\Local\Temp\Bootkits\6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\Bootkits\6B0CD0~1.EXE2⤵
-