f99b7e79cb5352202f3a68f84dc84621583c9cfcdb3bbbe8f17c8764cd4300bb | Triage

Sharing

General

Target

f99b7e79cb5352202f3a68f84dc84621583c9cfcdb3bbbe8f17c8764cd4300bb
Size

830KB
Sample

221002-26jx5sgbcl
MD5

66836690b5cc87384b240ba0bafca359
SHA1

cbed8b1e8f5b5626b3036486841ffcb5f3669ee5
SHA256

f99b7e79cb5352202f3a68f84dc84621583c9cfcdb3bbbe8f17c8764cd4300bb
SHA512

45bcd1da1d108bacf01a5b989d36a1f77cc7a4f1eaef03e2381bcf63ab8410d68a363aaaf3144f62adecb7242371e40aa6d80719f7a214d571c9382fbf30200f
SSDEEP

12288:zZhyOvPw8Ze6S9PFW/GVcGXxSJYxwvtCOMCQthGeknvg386wSe5/YBtdhW63LYP:z/eyMxAYOvtnahGpvvVSU/Y/TW64

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  f99b7e79cb5352202f3a68f84dc84621583c9cfcdb3bbbe8f17c8764cd4300bb
- Size
  
  830KB
- MD5
  
  66836690b5cc87384b240ba0bafca359
- SHA1
  
  cbed8b1e8f5b5626b3036486841ffcb5f3669ee5
- SHA256
  
  f99b7e79cb5352202f3a68f84dc84621583c9cfcdb3bbbe8f17c8764cd4300bb
- SHA512
  
  45bcd1da1d108bacf01a5b989d36a1f77cc7a4f1eaef03e2381bcf63ab8410d68a363aaaf3144f62adecb7242371e40aa6d80719f7a214d571c9382fbf30200f
- SSDEEP
  
  12288:zZhyOvPw8Ze6S9PFW/GVcGXxSJYxwvtCOMCQthGeknvg386wSe5/YBtdhW63LYP:z/eyMxAYOvtnahGpvvVSU/Y/TW64
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence