359d49736d20b77c00223a67f143c7ee103eee25aa32a84934d41bd48e059dce | Triage

Submit
Reports

Overview

overview

Static

static

359d49736d...ce.exe

windows7-x64

359d49736d...ce.exe

windows10-2004-x64

8

Sharing

General

Target

359d49736d20b77c00223a67f143c7ee103eee25aa32a84934d41bd48e059dce
Size

13.4MB
Sample

221123-lxkv3sce58
MD5

3143c00032a1ea047a24e780d1369e47
SHA1

3a3eddc54315f398642d707a345f8b2903e3abd9
SHA256

359d49736d20b77c00223a67f143c7ee103eee25aa32a84934d41bd48e059dce
SHA512

6c62dcc936c8c9f433469fbb1dd068be50f43ca9053a9ee7435859aed6a5bde1134c1bda1e8dd469e0805b95107bf89ebc730673b2d069959de7e820a4c14d83
SSDEEP

196608:dcepE527eDHmo4O8vUnIO+p+zRCND2uxLFx/CaGcmQjr138TvgFyQeQA:dceC5cS0OQUnbe9xLL6wmQMgJ7A

Score

10^/10

bootkit discovery evasion persistence

Static task

static1

Behavioral task

behavioral1

Sample

359d49736d20b77c00223a67f143c7ee103eee25aa32a84934d41bd48e059dce.exe

Resource

win7-20221111-en

bootkit discovery evasion persistence

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

359d49736d20b77c00223a67f143c7ee103eee25aa32a84934d41bd48e059dce.exe

Resource

win10v2004-20220812-en

bootkit persistence

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  359d49736d20b77c00223a67f143c7ee103eee25aa32a84934d41bd48e059dce
- Size
  
  13.4MB
- MD5
  
  3143c00032a1ea047a24e780d1369e47
- SHA1
  
  3a3eddc54315f398642d707a345f8b2903e3abd9
- SHA256
  
  359d49736d20b77c00223a67f143c7ee103eee25aa32a84934d41bd48e059dce
- SHA512
  
  6c62dcc936c8c9f433469fbb1dd068be50f43ca9053a9ee7435859aed6a5bde1134c1bda1e8dd469e0805b95107bf89ebc730673b2d069959de7e820a4c14d83
- SSDEEP
  
  196608:dcepE527eDHmo4O8vUnIO+p+zRCND2uxLFx/CaGcmQjr138TvgFyQeQA:dceC5cS0OQUnbe9xLL6wmQMgJ7A
Score

10^/10

bootkit discovery evasion persistence
- Modifies system executable filetype association
  persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Change Default File Association

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoveryevasionpersistence

behavioral2

bootkitpersistence

© 2018-2024

Terms | Privacy