Overview

overview

10

Static

static

codes.zip (1).exe

windows7_x64

8

codes.zip (1).exe

windows10_x64

10

Resubmissions

11-07-2021 12:14

210711-7n9zdpw47j 8

11-07-2021 12:14

210711-4d39x9vggj 8

11-07-2021 12:14

210711-lk364nq1vn 10

11-07-2021 11:45

210711-zaglhjen4n 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    codes.zip (1).exe

  • Size

    3.0MB

  • Sample

    210711-zaglhjen4n

  • MD5

    d857ed44ef2cf4d3e9676ecc68c149c9

  • SHA1

    90e49995309e8d20ab9596b1b8e6d80a90a5984b

  • SHA256

    d648e8e94c0674e6b1bd537936a33a39c33d3429d34fb70b97ff7f60904c9c84

  • SHA512

    7c9a7358e77c09b6ea463e9a77622c47ea245aa85c44b4190f0c55155a9b65ce42c9316f952fc72538725729b92c1ae725f06bba6df2c466eb66519fb2acdff5

Score
10/10
bootkitdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      codes.zip (1).exe

    • Size

      3.0MB

    • MD5

      d857ed44ef2cf4d3e9676ecc68c149c9

    • SHA1

      90e49995309e8d20ab9596b1b8e6d80a90a5984b

    • SHA256

      d648e8e94c0674e6b1bd537936a33a39c33d3429d34fb70b97ff7f60904c9c84

    • SHA512

      7c9a7358e77c09b6ea463e9a77622c47ea245aa85c44b4190f0c55155a9b65ce42c9316f952fc72538725729b92c1ae725f06bba6df2c466eb66519fb2acdff5

    Score
    10/10
    discoverybootkitevasionpersistencespywarestealertrojan

    • Registers COM server for autorun

      persistence

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Modify Existing Service

1
T1031

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Security Software Discovery

1
T1063

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks