baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344 | Triage

Sharing

General

Target

baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344
Size

7.9MB
Sample

220524-xp1gcaecf5
MD5

489cc8b0ccf627680dac49fea149e42c
SHA1

e9d9e02d771ce714ba5198b2809f22a21d2fb076
SHA256

baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344
SHA512

ef6ed6a6dcaf25579536d8b473006c01527220d7d59db3d82b7c6aeb71370973815cd921c9220bb6983da09ebcd29d70f20441a530335383a3970cecf4932472

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344
- Size
  
  7.9MB
- MD5
  
  489cc8b0ccf627680dac49fea149e42c
- SHA1
  
  e9d9e02d771ce714ba5198b2809f22a21d2fb076
- SHA256
  
  baafd8f9b5889d49921f5e4c6fc3ca051f42d1c50a6b1db65986bcfb6e10f344
- SHA512
  
  ef6ed6a6dcaf25579536d8b473006c01527220d7d59db3d82b7c6aeb71370973815cd921c9220bb6983da09ebcd29d70f20441a530335383a3970cecf4932472
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Security Software Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence