dc5fed7c9fce12ce683199b56ddf5aa9dd0f80f30e96cbfa3d55343d8b4a0b3f | Triage

Sharing

General

Target

dc5fed7c9fce12ce683199b56ddf5aa9dd0f80f30e96cbfa3d55343d8b4a0b3f
Size

798KB
Sample

221011-hbm7jaacf4
MD5

7c7c5b13c041a2f3fac951a38b9fda8d
SHA1

2c9e478c56a634a6be1cc4e6667823566641da2c
SHA256

dc5fed7c9fce12ce683199b56ddf5aa9dd0f80f30e96cbfa3d55343d8b4a0b3f
SHA512

0cf5bdcbdd01b7b867e8d201486613796b01e24cd2b6cb03016b19560efac889e1c2474729f2553bdeb133d09d1628e4c3f646578668ebc35294305ad1f48397
SSDEEP

12288:VTrNHOHkbIDB2GuFfom8qQ+HrF92F+T+6GXtVvlwhUteIfHqu7eTMgb4+fD61:VtuHkI2GuFwqT7SJ9GUteIt7eTMA4+f

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  dc5fed7c9fce12ce683199b56ddf5aa9dd0f80f30e96cbfa3d55343d8b4a0b3f
- Size
  
  798KB
- MD5
  
  7c7c5b13c041a2f3fac951a38b9fda8d
- SHA1
  
  2c9e478c56a634a6be1cc4e6667823566641da2c
- SHA256
  
  dc5fed7c9fce12ce683199b56ddf5aa9dd0f80f30e96cbfa3d55343d8b4a0b3f
- SHA512
  
  0cf5bdcbdd01b7b867e8d201486613796b01e24cd2b6cb03016b19560efac889e1c2474729f2553bdeb133d09d1628e4c3f646578668ebc35294305ad1f48397
- SSDEEP
  
  12288:VTrNHOHkbIDB2GuFfom8qQ+HrF92F+T+6GXtVvlwhUteIfHqu7eTMgb4+fD61:VtuHkI2GuFwqT7SJ9GUteIt7eTMA4+f
Score

6^/10

bootkit persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence