Overview

overview

8

Static

static

91aae84766...5c.exe

windows7_x64

8

91aae84766...5c.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91aae84766c2de1d3b27454cd3af4bc3545174320b0ef7accec7e21399ff9c5c

  • Size

    648KB

  • Sample

    220521-aj22nadccj

  • MD5

    cd34f38572c62fce4fe8d935b1f06fef

  • SHA1

    e39fcac6bde543f90d62da4fb46b2a4b9a0e54b7

  • SHA256

    91aae84766c2de1d3b27454cd3af4bc3545174320b0ef7accec7e21399ff9c5c

  • SHA512

    62196ea1d66dac5ec6576c227c22ddc73d2e0b180f943f46cacc85f74dac2b6030b6c9296e176721631e8689a79cbb3efa242ed61ab00cb295403daac6cb113b

Score
8/10
bootkitmacromacro_on_actionpersistence

Malware Config

Targets

    • Target

      91aae84766c2de1d3b27454cd3af4bc3545174320b0ef7accec7e21399ff9c5c

    • Size

      648KB

    • MD5

      cd34f38572c62fce4fe8d935b1f06fef

    • SHA1

      e39fcac6bde543f90d62da4fb46b2a4b9a0e54b7

    • SHA256

      91aae84766c2de1d3b27454cd3af4bc3545174320b0ef7accec7e21399ff9c5c

    • SHA512

      62196ea1d66dac5ec6576c227c22ddc73d2e0b180f943f46cacc85f74dac2b6030b6c9296e176721631e8689a79cbb3efa242ed61ab00cb295403daac6cb113b

    Score
    8/10
    bootkitmacromacro_on_actionpersistence

    • Office macro that triggers on suspicious action

      Office document macro which triggers in special circumstances - often malicious.

      macromacro_on_action

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks