022728f678d8dcc6cba20147595ed4099e9c98be0582c0f67518d5664e3b8523 | Triage

Analysis

max time kernel
90s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-uk
resource tags

arch:x64arch:x86image:win10v2004-20240226-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
03-03-2024 13:53

Sharing

Report Analysis Logs

General

Target

Ransomware/Seftad.exe
Size

48KB
MD5

86a3a3ce16360e01933d71d0bf1f2c37
SHA1

af54089e3601c742d523b507b3a0793c2b6e60be
SHA256

2ebe23ba9897d9c127b9c0a737ba63af8d0bcd76ec866610cc0b5de2f62b87bd
SHA512

65a3571cf5b057d2c3ce101346947679f162018fa5eadf79c5a6af6c0a3bc9b12731ff13f27629b14983ef8bc73fa9782cc0a9e6c44b0ffc2627da754c324d6e
SSDEEP

768:WQbWH9cNN5EM4Xk9fFhPc28F3hT/BysVPkzEDGlnwOMYsGfM:v8cbWMFO28FxT3VPkpk

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

Seftad.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 Seftad.exe

C:\Users\Admin\AppData\Local\Temp\Ransomware\Seftad.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Seftad.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:3832

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...