Overview

overview

8

Static

static

4fdef6f532...27.exe

windows7-x64

8

4fdef6f532...27.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    4fdef6f532205941cd6ec8f9f55ee69cd67d8edebbd344d47bc798c0a47c7f27

  • Size

    856KB

  • Sample

    221002-qthzjaghf4

  • MD5

    4451d4fe1d94d80659a1ef5d266e1460

  • SHA1

    8490dc8a492627d56eaca703e3cec6ca9331fd70

  • SHA256

    4fdef6f532205941cd6ec8f9f55ee69cd67d8edebbd344d47bc798c0a47c7f27

  • SHA512

    729d7bae3bea7dd406e3f493b31a5b5b437dad1f38c703646713423751283aa551b3d8ebccd18abd3c3fe538c3fa45d11637632a06e21e9f668c313784a02b99

  • SSDEEP

    24576:xNowb8GOVZAQYCOevQMUOGIgFzaKc7NoN/P9wh6ibKOFU6E8Rb:L8GfFkscGNWhH1FxE8Rb

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      4fdef6f532205941cd6ec8f9f55ee69cd67d8edebbd344d47bc798c0a47c7f27

    • Size

      856KB

    • MD5

      4451d4fe1d94d80659a1ef5d266e1460

    • SHA1

      8490dc8a492627d56eaca703e3cec6ca9331fd70

    • SHA256

      4fdef6f532205941cd6ec8f9f55ee69cd67d8edebbd344d47bc798c0a47c7f27

    • SHA512

      729d7bae3bea7dd406e3f493b31a5b5b437dad1f38c703646713423751283aa551b3d8ebccd18abd3c3fe538c3fa45d11637632a06e21e9f668c313784a02b99

    • SSDEEP

      24576:xNowb8GOVZAQYCOevQMUOGIgFzaKc7NoN/P9wh6ibKOFU6E8Rb:L8GfFkscGNWhH1FxE8Rb

    Score
    8/10
    bootkitpersistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks