6b807e6e7073325abb3a0511e37a574581bda56791736f4d04f8f87983273bc3

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1812dff52d91ed94e3aad28b5284fa63.exe
Size

140KB
MD5

1812dff52d91ed94e3aad28b5284fa63
SHA1

9d734ce8aa0ae3838d8f7347dca656ca23e898fb
SHA256

6b807e6e7073325abb3a0511e37a574581bda56791736f4d04f8f87983273bc3
SHA512

7547e3985e991ba7e5b92038e58b1b569ff28481195448fe5f7c90271f57ec520cbbf6511a5ae1cefa17d096049aeb0facc8581b891af29a21f00383e4190018
SSDEEP

1536:RXFaUIIsyovbdu5LXpPEUsQit0bcUrpygl/5YWkJ5TkcylWilquKh:R4Tj5RVXQ+rEDfQ5TJylWanKh

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	1812dff52d91ed94e3aad28b5284fa63.exe

C:\Users\Admin\AppData\Local\Temp\1812dff52d91ed94e3aad28b5284fa63.exe
"C:\Users\Admin\AppData\Local\Temp\1812dff52d91ed94e3aad28b5284fa63.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads