Overview

overview

10

Static

static

d48f9b157d...90.exe

windows7-x64

10

d48f9b157d...90.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d48f9b157d7e4e9601ba7dd59655e05945eb2fe70da09e86fad8567c6c515190

  • Size

    208KB

  • Sample

    220919-ngfbrsaeaj

  • MD5

    1690e0408b941cfe9f8d8ffe46bb9481

  • SHA1

    03d3a9c8e5bff263caa06c4795bd4dca2d1561c7

  • SHA256

    d48f9b157d7e4e9601ba7dd59655e05945eb2fe70da09e86fad8567c6c515190

  • SHA512

    02a272ca995f123df7becf79b4b3a17b11f5fbcfbcac070c001d20b79a07035cdc99b10a72554728591b6370e3eedb58649dc4fff102322fc2fa06ecb67d6bc6

  • SSDEEP

    6144:jZA/L880NEJji+5rqqULirD2Ei/NjO50p8I4cC:je/L880NEJjBdrm/fGI4D

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      d48f9b157d7e4e9601ba7dd59655e05945eb2fe70da09e86fad8567c6c515190

    • Size

      208KB

    • MD5

      1690e0408b941cfe9f8d8ffe46bb9481

    • SHA1

      03d3a9c8e5bff263caa06c4795bd4dca2d1561c7

    • SHA256

      d48f9b157d7e4e9601ba7dd59655e05945eb2fe70da09e86fad8567c6c515190

    • SHA512

      02a272ca995f123df7becf79b4b3a17b11f5fbcfbcac070c001d20b79a07035cdc99b10a72554728591b6370e3eedb58649dc4fff102322fc2fa06ecb67d6bc6

    • SSDEEP

      6144:jZA/L880NEJji+5rqqULirD2Ei/NjO50p8I4cC:je/L880NEJjBdrm/fGI4D

    Score
    10/10
    bootkitevasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks