720ed2361d8b4a57ba0e34b2ddff6679611965dea1b44f33c3c435c18836633a | Triage

Sharing

General

Target

720ed2361d8b4a57ba0e34b2ddff6679611965dea1b44f33c3c435c18836633a
Size

319KB
Sample

221123-s31l2sch94
MD5

d946516ef504c78e295d937462db0fd5
SHA1

7c671c3cfea0f5a11e3936322015b2d8edb03023
SHA256

720ed2361d8b4a57ba0e34b2ddff6679611965dea1b44f33c3c435c18836633a
SHA512

7302b59e759682065aa79dc48c1ee5c2e1734f35f99e0a6dda308ee1128b33284f6255f0b4315adba8c7d18cc7685e26efb00bea573504896925d1d193b28f2a
SSDEEP

6144:3QeVK+irfKx/8GcsMBvMCmJp2NdVDJIJSAAZw:3QeVLI+esTCmCNd5JzjZw

Score

8^/10

bootkit evasion persistence trojan

Malware Config

Targets

- Target
  
  720ed2361d8b4a57ba0e34b2ddff6679611965dea1b44f33c3c435c18836633a
- Size
  
  319KB
- MD5
  
  d946516ef504c78e295d937462db0fd5
- SHA1
  
  7c671c3cfea0f5a11e3936322015b2d8edb03023
- SHA256
  
  720ed2361d8b4a57ba0e34b2ddff6679611965dea1b44f33c3c435c18836633a
- SHA512
  
  7302b59e759682065aa79dc48c1ee5c2e1734f35f99e0a6dda308ee1128b33284f6255f0b4315adba8c7d18cc7685e26efb00bea573504896925d1d193b28f2a
- SSDEEP
  
  6144:3QeVK+irfKx/8GcsMBvMCmJp2NdVDJIJSAAZw:3QeVLI+esTCmCNd5JzjZw
Score

8^/10

bootkit persistence evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

evasionpersistencetrojan