00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1 | Triage

Sharing

General

Target

00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1
Size

844KB
Sample

221029-25l14sbfgr
MD5

83f486d1953416ccf18c378009efc528
SHA1

a48f3aebf1e26c12b498e6d66ca599d10c763b35
SHA256

00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1
SHA512

641962a04feb1dc9e1baf4d4b06ea5362fc4836f3b87cf013d5ce53e2729b682b5b52c11af106e1ce870e1a1874ebdaabbb96a6c0137ae563c00ba72368c1225
SSDEEP

12288:/U8+JhYTdmEfwaygnXvkxWUWBD+Ss1engI7ueSLygbZ3/ictSW9IapSU2B:/GJOEAwaygnXv2wa3enT7m/GNi2B

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1
- Size
  
  844KB
- MD5
  
  83f486d1953416ccf18c378009efc528
- SHA1
  
  a48f3aebf1e26c12b498e6d66ca599d10c763b35
- SHA256
  
  00d48daf7d46d76dd102527a48b6243d7e77d4f85b867044de99dfb3b2ddf9b1
- SHA512
  
  641962a04feb1dc9e1baf4d4b06ea5362fc4836f3b87cf013d5ce53e2729b682b5b52c11af106e1ce870e1a1874ebdaabbb96a6c0137ae563c00ba72368c1225
- SSDEEP
  
  12288:/U8+JhYTdmEfwaygnXvkxWUWBD+Ss1engI7ueSLygbZ3/ictSW9IapSU2B:/GJOEAwaygnXv2wa3enT7m/GNi2B
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence