Analysis

  • max time kernel
    141s
  • max time network
    55s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 00:47

General

  • Target

    Exsc.exe

  • Size

    7.9MB

  • MD5

    dba03fe050ccd6d8285f74037185225a

  • SHA1

    16b6bd89c3deaab02fa1f0ddb1c4e50771822fc9

  • SHA256

    dd40f84cc9b5cbe312bd5b032ce19222779ea35644fa55f5fc2117583fe2a427

  • SHA512

    beb56a25b0351864aed7527dfc800ceb797319c08e357ef1e91508c28b039b97af83a1d9821a542cae0b2b29e2370c2facfd876390a1bec6c68f48537824f1ef

  • SSDEEP

    49152:3QdmljjneamRMJENiMLSJ/dk3n+YJRrXLD2QN9hv8Lp8HJlcRTe+4GC15V4:Adk9JEwDalnrXLK2vV4h4GC15V

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Exsc.exe
    "C:\Users\Admin\AppData\Local\Temp\Exsc.exe"
    1⤵
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    PID:4000

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4000-0-0x00000000011C0000-0x00000000011C1000-memory.dmp
    Filesize

    4KB

  • memory/4000-1-0x0000000000400000-0x0000000000FC2000-memory.dmp
    Filesize

    11.8MB

  • memory/4000-3-0x00000000011C0000-0x00000000011C1000-memory.dmp
    Filesize

    4KB