Overview

overview

8

Static

static

7b2022b368...82.exe

windows7-x64

8

7b2022b368...82.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b2022b368d6930f91a360c1bbd5c98fce768b09cfff3c0a6e41ac7203c79482

  • Size

    986KB

  • Sample

    221002-26h1vaegd3

  • MD5

    07ba1578eb9a67706aedf0fcaa7e9412

  • SHA1

    33ca06048cb0ea43e145c364168771e115fa2a60

  • SHA256

    7b2022b368d6930f91a360c1bbd5c98fce768b09cfff3c0a6e41ac7203c79482

  • SHA512

    ca4d0dd4b817dacdc0192a671493273b9c4ece1b2533c69b006df69cad6eec5d75bbe3b2d0207d688cdb01177ef53eaee32d0994deac34cae3c583e9227d224c

  • SSDEEP

    24576:Gf/Z9arRbSnCS/ZmExYaEsAGSTU9twGTdK8kUu1hLMGR:ACFbSCSIEiLsA+92udK8bK7R

Score
8/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      7b2022b368d6930f91a360c1bbd5c98fce768b09cfff3c0a6e41ac7203c79482

    • Size

      986KB

    • MD5

      07ba1578eb9a67706aedf0fcaa7e9412

    • SHA1

      33ca06048cb0ea43e145c364168771e115fa2a60

    • SHA256

      7b2022b368d6930f91a360c1bbd5c98fce768b09cfff3c0a6e41ac7203c79482

    • SHA512

      ca4d0dd4b817dacdc0192a671493273b9c4ece1b2533c69b006df69cad6eec5d75bbe3b2d0207d688cdb01177ef53eaee32d0994deac34cae3c583e9227d224c

    • SSDEEP

      24576:Gf/Z9arRbSnCS/ZmExYaEsAGSTU9twGTdK8kUu1hLMGR:ACFbSCSIEiLsA+92udK8bK7R

    Score
    8/10
    bootkitevasionpersistencetrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks