ff8bbb7ac6f668befbb9b91ef9e3b5b792a1459436423a12996771df2982b630 | Triage

Sharing

General

Target

ff8bbb7ac6f668befbb9b91ef9e3b5b792a1459436423a12996771df2982b630
Size

863KB
Sample

221011-vwmsqafdhq
MD5

2aefe26eba53a75ca3b663545549f020
SHA1

9be4c98aaaf9669138a98fbd1008c82d35dbefb9
SHA256

ff8bbb7ac6f668befbb9b91ef9e3b5b792a1459436423a12996771df2982b630
SHA512

e6c82853bf943325ba49e767058750c5e5164ea38623d917f2fa46853df3425df3dc2dd96fb225349b87203855491361f5611c533f316117244900cd3fa85bd1
SSDEEP

12288:ti7TnKAB6uTsseXay+oD02kJvIqYXQ/byNZj6CGtp4juSl0I1whVIMHclz0/3Cgb:4xo2eKIFUIlXQ/sZ+alN1qd8B0/31

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  ff8bbb7ac6f668befbb9b91ef9e3b5b792a1459436423a12996771df2982b630
- Size
  
  863KB
- MD5
  
  2aefe26eba53a75ca3b663545549f020
- SHA1
  
  9be4c98aaaf9669138a98fbd1008c82d35dbefb9
- SHA256
  
  ff8bbb7ac6f668befbb9b91ef9e3b5b792a1459436423a12996771df2982b630
- SHA512
  
  e6c82853bf943325ba49e767058750c5e5164ea38623d917f2fa46853df3425df3dc2dd96fb225349b87203855491361f5611c533f316117244900cd3fa85bd1
- SSDEEP
  
  12288:ti7TnKAB6uTsseXay+oD02kJvIqYXQ/byNZj6CGtp4juSl0I1whVIMHclz0/3Cgb:4xo2eKIFUIlXQ/sZ+alN1qd8B0/31
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence