Analysis
-
max time kernel
131s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 07:26
Static task
static1
Behavioral task
behavioral1
Sample
6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe
Resource
win10v2004-20240508-en
General
-
Target
6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe
-
Size
12.8MB
-
MD5
a30aad8b4d22353aee1721b0a0bb2ba2
-
SHA1
c06fd24e245192e0153e16c08f9565dbca1087d1
-
SHA256
6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318
-
SHA512
8d722b0193d934d922d643012f88f6f92e73fbdb5c5185508d19ec3eacc7e394e98876d8f2c8ae2b5d2b748b55e1a8bb9e4fd183b85dbf8bc4126d12fb1b07c2
-
SSDEEP
393216:iHV38/A2/4m74bWLUDtwBPq/2FwQGD9guuZGQM35:GVfA4zbQGCnGD
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exedescription ioc process File opened for modification \??\PhysicalDrive0 6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exepid process 2368 6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe 2368 6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe 2368 6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe 2368 6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe 2368 6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe 2368 6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe"C:\Users\Admin\AppData\Local\Temp\6d5207dc5a6741db8beeccdcbf7ecff01714ecddc03c5342213a79b18ddca318.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses