451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa.exe
Size

12.0MB
MD5

54c1f51e339ebc96bd5e0bde1bb9b8df
SHA1

7523fa188bab5d36b264c6715b453d1824c6983d
SHA256

451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa
SHA512

81951728adb6f4ea06606552d770d57f452452db9cdbdcaf7d7be3ebc23ccfeacd31693bc7464df194730d04034b7f612fcdbc3ea0c46a8aaa3b6ccc4321433b
SSDEEP

196608:G3wFIFaQEud7cmACFck0C6R1ZrB3fg+vgQN7FJqvZPx+pZdzLTTYqCB7/IVTlQt:GQc3pACSRrrdffN7FJMpIJTYqCZSRQ

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2228	451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa.exe
2228	451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa.exe
2228	451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa.exe
2228	451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa.exe

C:\Users\Admin\AppData\Local\Temp\451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa.exe
"C:\Users\Admin\AppData\Local\Temp\451d4ad10a18aee97d3b7182160000bb4c8c24e8d33b69c64cfad69c60db6daa.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-0-0x0000000010000000-0x0000000010194000-memory.dmp

Filesize
1.6MB

Download
memory/2228-6-0x0000000003430000-0x000000000359B000-memory.dmp

Filesize
1.4MB

Download
memory/2228-16-0x0000000003910000-0x0000000003950000-memory.dmp

Filesize
256KB

Download
memory/2228-25-0x0000000003910000-0x0000000003950000-memory.dmp

Filesize
256KB

Download