Overview

overview

6

Static

static

d64cd96867...73.exe

windows7_x64

6

d64cd96867...73.exe

windows10-2004_x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d64cd968677e2d02f1f11edd05d56994eafb6d9687d6e0aa5b98718e24f8c773

  • Size

    21KB

  • Sample

    220516-cvzrsaade2

  • MD5

    fb0a226376d060173dea88a60f19661b

  • SHA1

    331cc3e10b234ff4b27b9a19cd76516fab3043eb

  • SHA256

    d64cd968677e2d02f1f11edd05d56994eafb6d9687d6e0aa5b98718e24f8c773

  • SHA512

    e4d978c8f88db943c5602fda998f93ba3d09a6169e7e9f39bd025d86dd21ab985492787e741c5ab207af2c33e988f75f8e7e190d59fb25b8be152dccd550fe88

Score
6/10
bootkitpersistence

Malware Config

Targets

    • Target

      d64cd968677e2d02f1f11edd05d56994eafb6d9687d6e0aa5b98718e24f8c773

    • Size

      21KB

    • MD5

      fb0a226376d060173dea88a60f19661b

    • SHA1

      331cc3e10b234ff4b27b9a19cd76516fab3043eb

    • SHA256

      d64cd968677e2d02f1f11edd05d56994eafb6d9687d6e0aa5b98718e24f8c773

    • SHA512

      e4d978c8f88db943c5602fda998f93ba3d09a6169e7e9f39bd025d86dd21ab985492787e741c5ab207af2c33e988f75f8e7e190d59fb25b8be152dccd550fe88

    Score
    6/10
    bootkitpersistence

    • Program crash

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks