5cb05fc3b5c08730ad7824971df887c658bfd9f88cd828f54e51c3918c298cfb

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_ac282c5026ebc5081fb45dfc0bda669f_mafia.exe
Size

1.1MB
MD5

ac282c5026ebc5081fb45dfc0bda669f
SHA1

82d88f822d5900b810ea8ce5295b127786f58a1e
SHA256

5cb05fc3b5c08730ad7824971df887c658bfd9f88cd828f54e51c3918c298cfb
SHA512

ee54cb469d9542f0da93075affdd2fc8d179697a0fd08bbc9c579777234055db1b5fd5b53c74db000573e81edc8d057fdcc7734f1994978704aa80ce2a1e83c6
SSDEEP

24576:qIMjEvIew6MDQH1zIG7QK8gsR9sQ33O46bIm6gQJgk87k8b:IYjc3gsR9sP46bIm6gQJgk87k8b

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

2024-05-22_ac282c5026ebc5081fb45dfc0bda669f_mafia.exe

description ioc process

File opened for modification \??\PhysicalDrive0 2024-05-22_ac282c5026ebc5081fb45dfc0bda669f_mafia.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	2024-05-22_ac282c5026ebc5081fb45dfc0bda669f_mafia.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_ac282c5026ebc5081fb45dfc0bda669f_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_ac282c5026ebc5081fb45dfc0bda669f_mafia.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\Baidu\Common\I18N\conf.db

Filesize
403B

MD5
118b9dfb0c4132a3d744099aa9568505

SHA1
d25aa58656e14d32a17057393bc567a4a502ef04

SHA256
5882144dde68a161a426009a3c91d7b2122147fce33e6a906fefa2d870308962

SHA512
0f763dfd0084d6ea3e874263ab2ae7ec89c2cc710fc4d49c683ec8d19a595601f22c9fec44b6f7ce8732dec51b3e8e48deb28a3d5cac51468bc15f92d6c888ee

Download Submit
memory/2644-9-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download