Overview

overview

8

Static

static

d47c38a620...1a.exe

windows7-x64

8

d47c38a620...1a.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d47c38a620bc1450f1fea3ad6cd3b722d146b82da977e8a842ce7d55c724bf1a

  • Size

    131KB

  • Sample

    220919-tjp7msfhe3

  • MD5

    96913d6244f6bb0ab29ce62eec1d559e

  • SHA1

    819d65aa67cca7eeaf2755c7a73ed4d62f4a9ad8

  • SHA256

    d47c38a620bc1450f1fea3ad6cd3b722d146b82da977e8a842ce7d55c724bf1a

  • SHA512

    d2205cc958e39005d5009eb32b9d52e2a9c5d66354160376e4e6568cb1e32359700810d748ec968b8028616457883331237af57747dba13f032771756633c63a

  • SSDEEP

    3072:2GW3B+DukJ7F8wg5xamn7ZYj0azIX8LXwDIukqwr1Q9u:2Jq8wg5xp7Z1X8LADIudwr3

Score
8/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      d47c38a620bc1450f1fea3ad6cd3b722d146b82da977e8a842ce7d55c724bf1a

    • Size

      131KB

    • MD5

      96913d6244f6bb0ab29ce62eec1d559e

    • SHA1

      819d65aa67cca7eeaf2755c7a73ed4d62f4a9ad8

    • SHA256

      d47c38a620bc1450f1fea3ad6cd3b722d146b82da977e8a842ce7d55c724bf1a

    • SHA512

      d2205cc958e39005d5009eb32b9d52e2a9c5d66354160376e4e6568cb1e32359700810d748ec968b8028616457883331237af57747dba13f032771756633c63a

    • SSDEEP

      3072:2GW3B+DukJ7F8wg5xamn7ZYj0azIX8LXwDIukqwr1Q9u:2Jq8wg5xp7Z1X8LADIudwr3

    Score
    8/10
    upxbootkitpersistence

    • Drops file in Drivers directory

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks