00e2376865557b05fdd63611500907c49276ef1642c5dfbfef11cc5bf725ace5

Analysis

max time kernel
142s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00e2376865557b05fdd63611500907c49276ef1642c5dfbfef11cc5bf725ace5.exe
Size

522KB
MD5

8d9ebdf95cecfc70d7865263c95674b8
SHA1

b599474e02abc84d8daa24e2fd4e5ddc59343eb4
SHA256

00e2376865557b05fdd63611500907c49276ef1642c5dfbfef11cc5bf725ace5
SHA512

e96dc2cdee57fffca36f10491ec0864524614e6be05ca483ef8a1d9b62497017fbdfef57d7cf66016bdfb9f194ac984afbe6e42a6418cac135383fb45ae01d15
SSDEEP

12288:9HT+gDr0JFudeaVHy95ni8NRtToqarZNV+u6:9z+uyTGHyLni8ftsqeH6

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

00e2376865557b05fdd63611500907c49276ef1642c5dfbfef11cc5bf725ace5.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 00e2376865557b05fdd63611500907c49276ef1642c5dfbfef11cc5bf725ace5.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	00e2376865557b05fdd63611500907c49276ef1642c5dfbfef11cc5bf725ace5.exe

C:\Users\Admin\AppData\Local\Temp\00e2376865557b05fdd63611500907c49276ef1642c5dfbfef11cc5bf725ace5.exe
"C:\Users\Admin\AppData\Local\Temp\00e2376865557b05fdd63611500907c49276ef1642c5dfbfef11cc5bf725ace5.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:2888

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-3-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2888-2-0x0000000004940000-0x00000000049AB000-memory.dmp

Filesize
428KB

Download
memory/2888-1-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download
memory/2888-4-0x0000000000400000-0x0000000002C3B000-memory.dmp

Filesize
40.2MB

Download
memory/2888-5-0x0000000000400000-0x0000000002C3B000-memory.dmp

Filesize
40.2MB

Download
memory/2888-6-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download
memory/2888-8-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download