Overview

overview

10

Static

static

9fb1fdd0bc...59.exe

windows7-x64

10

9fb1fdd0bc...59.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fb1fdd0bce290c381871d44168a89a7b4fdaa494d3c9698b6b71cf34754eb59

  • Size

    633KB

  • Sample

    221003-hdjxwsdben

  • MD5

    3bf12b0c22b74b6872cfd1173407dce3

  • SHA1

    28da93920f4ead65f84acd428652764ddc8b257e

  • SHA256

    9fb1fdd0bce290c381871d44168a89a7b4fdaa494d3c9698b6b71cf34754eb59

  • SHA512

    2580f87caa816a8fb9eebe4b31e5658cd588ae60f7856f697002829a5c7f3c44503def39330ebd3f65b1e6506792616b0d084a06593c7f0eafb33706f3f2657b

  • SSDEEP

    12288:hKr6SBsPOq2WGhQDtGIYA3DugBIWDwLDFRB:IPYP2WGaDtjYkufLDFP

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      9fb1fdd0bce290c381871d44168a89a7b4fdaa494d3c9698b6b71cf34754eb59

    • Size

      633KB

    • MD5

      3bf12b0c22b74b6872cfd1173407dce3

    • SHA1

      28da93920f4ead65f84acd428652764ddc8b257e

    • SHA256

      9fb1fdd0bce290c381871d44168a89a7b4fdaa494d3c9698b6b71cf34754eb59

    • SHA512

      2580f87caa816a8fb9eebe4b31e5658cd588ae60f7856f697002829a5c7f3c44503def39330ebd3f65b1e6506792616b0d084a06593c7f0eafb33706f3f2657b

    • SSDEEP

      12288:hKr6SBsPOq2WGhQDtGIYA3DugBIWDwLDFRB:IPYP2WGaDtjYkufLDFP

    Score
    10/10
    bootkitevasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks