Overview

overview

10

Static

static

8

aeba954a9b...ea.exe

windows7_x64

10

aeba954a9b...ea.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea

  • Size

    1008KB

  • Sample

    220520-emr33shah3

  • MD5

    8d17b6f739b852720928542609534f25

  • SHA1

    ba078a4a2adc7766e94d36b53c2d1082b4e21be3

  • SHA256

    aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea

  • SHA512

    74cdb18a02f0d31051d1b598677a364106a1d0d07ba5db6dd4a019dc6af9df919307eb9a9c8be8c4945adf3cf458b07b501ce7c63fc396fb9a04b3ff3104607b

Score
10/10
bootkitdiscoverypersistenceupx

Malware Config

Targets

    • Target

      aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea

    • Size

      1008KB

    • MD5

      8d17b6f739b852720928542609534f25

    • SHA1

      ba078a4a2adc7766e94d36b53c2d1082b4e21be3

    • SHA256

      aeba954a9b3afa58807aad0b266745c8bad637ac2cfedf3cfb4f11745ad85fea

    • SHA512

      74cdb18a02f0d31051d1b598677a364106a1d0d07ba5db6dd4a019dc6af9df919307eb9a9c8be8c4945adf3cf458b07b501ce7c63fc396fb9a04b3ff3104607b

    Score
    10/10
    bootkitdiscoverypersistence

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

2
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks