a175964cfab829cfe7dd87d12ed99d8a5b0e6ef9676fc9e0fec0555fe875b637 | Triage

Sharing

General

Target

a175964cfab829cfe7dd87d12ed99d8a5b0e6ef9676fc9e0fec0555fe875b637
Size

843KB
Sample

221019-1zdxwaaec2
MD5

a219e2c42413ac4fe41bcec7545c3570
SHA1

ec42609672cacd11202de82fc833c2388e8b49da
SHA256

a175964cfab829cfe7dd87d12ed99d8a5b0e6ef9676fc9e0fec0555fe875b637
SHA512

54b04179bf9048074530e072a795bfe232f07e322e4b1aa8140cde1cf4b45ddf2d32d0fc94df8db7944f957ba8a4d85451b733a7ff571ecc51b1c8a957b6f640
SSDEEP

24576:YLAPic5d4ak4o4p/JA229HMxcfuYjUUUUUUUUUUUUUUUUUUUU:YkanaLoC/JA229HvfuYjUUUUUUUUUUUE

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  a175964cfab829cfe7dd87d12ed99d8a5b0e6ef9676fc9e0fec0555fe875b637
- Size
  
  843KB
- MD5
  
  a219e2c42413ac4fe41bcec7545c3570
- SHA1
  
  ec42609672cacd11202de82fc833c2388e8b49da
- SHA256
  
  a175964cfab829cfe7dd87d12ed99d8a5b0e6ef9676fc9e0fec0555fe875b637
- SHA512
  
  54b04179bf9048074530e072a795bfe232f07e322e4b1aa8140cde1cf4b45ddf2d32d0fc94df8db7944f957ba8a4d85451b733a7ff571ecc51b1c8a957b6f640
- SSDEEP
  
  24576:YLAPic5d4ak4o4p/JA229HMxcfuYjUUUUUUUUUUUUUUUUUUUU:YkanaLoC/JA229HvfuYjUUUUUUUUUUUE
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence