2eaccf2ffad0c83282b940b5ed1e65f38acacc9e002b48e3bf4f852e1097232a

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ransomwares/PetyaMFTDestroyer/PetyaMFTDestroyer.exe
Size

14KB
MD5

a8a9916266bd2cbbca8850c6c67a915c
SHA1

5aeb52141addd70e408761d9bdad00751b995eac
SHA256

07f5eeb863d8e000fd24cffbf278fae627a0872afb03db01f700355656a883fd
SHA512

21e11f9d7b93dceb740fe157d6cc006ad24cb92d51769c471cdd8e63da8e87eacb8350cf8365ba7b64370ec8cc5ca6800d010fa266044a9706e9e347fbb03fef
SSDEEP

192:gcUFGq6c+3a6mY49OD2JgH+q3QQ4B/W1bSyg+0SfEl:geaHYzyJE+q3QQ4B/WUyg7

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	PetyaMFTDestroyer.exe

C:\Users\Admin\AppData\Local\Temp\ransomwares\PetyaMFTDestroyer\PetyaMFTDestroyer.exe
"C:\Users\Admin\AppData\Local\Temp\ransomwares\PetyaMFTDestroyer\PetyaMFTDestroyer.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads