0d4e910847a8da89c1a61e75ddd8db232083e735486178457c547e6a3958dcc1

Analysis

max time kernel
155s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BDDownloadExe.exe
Size 367KB
Sample240526-md41aaff62
SHA256 68ed1dc5216bc98e95b938643b44160805fb9564966ba3baa515df526ce6cff0
MD5 2f5aa7abfbbf2b087f9e4dfe423bd6a1
SHA1 c54a1c7d55272efc2733eea8c92e4e5d5b88c36d
SHA512 f296c689b22ccf8d55f385e22f29e5e7e059daa44577eba05a8e42706abae4c9292c16fc9fe44d671ffb816960e69317aa5fbafb7e0702acf4f2608c6c0db719
SSDEEP 6144:AJwx+zTO02TvEUSzi1G6/InjNx9LtEmCR1/gxKrpU1QUTive:AJwx+zTBtzi18xzBEmCRixBive
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	BDDownloadExe.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe
1376	BDDownloadExe.exe

C:\Users\Admin\AppData\Local\Temp\BDDownloadExe.exe
"C:\Users\Admin\AppData\Local\Temp\BDDownloadExe.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2756 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads