Overview

overview

10

Static

static

f9f6a34294...25.exe

windows7-x64

10

f9f6a34294...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9f6a342949866e404ca538b4e1b142970f4ff6e235044632be7a2ea59eaa725

  • Size

    560KB

  • Sample

    221124-h9ps1sgf94

  • MD5

    64f82b9173cd9db3756fcbb0207ec356

  • SHA1

    53419f0f85640e1a40dfdb724ae6e78e7df9fd6b

  • SHA256

    f9f6a342949866e404ca538b4e1b142970f4ff6e235044632be7a2ea59eaa725

  • SHA512

    b18aaf19b1851b94c6f9c03c4a3cd66ae3fb005c1941dfd181b799f965c4d262c35c60ba3e3004704a73dada201d3bf2c2b0e39fcff7c0b574eef8710bc4427d

  • SSDEEP

    12288:9Uo991Egcc0U6PINcTVDBb6rGkcXMK1wF9cSQDbi:9UoP1Egcc0RIN7rAM5F9cSQDb

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      f9f6a342949866e404ca538b4e1b142970f4ff6e235044632be7a2ea59eaa725

    • Size

      560KB

    • MD5

      64f82b9173cd9db3756fcbb0207ec356

    • SHA1

      53419f0f85640e1a40dfdb724ae6e78e7df9fd6b

    • SHA256

      f9f6a342949866e404ca538b4e1b142970f4ff6e235044632be7a2ea59eaa725

    • SHA512

      b18aaf19b1851b94c6f9c03c4a3cd66ae3fb005c1941dfd181b799f965c4d262c35c60ba3e3004704a73dada201d3bf2c2b0e39fcff7c0b574eef8710bc4427d

    • SSDEEP

      12288:9Uo991Egcc0U6PINcTVDBb6rGkcXMK1wF9cSQDbi:9UoP1Egcc0RIN7rAM5F9cSQDb

    Score
    10/10
    bootkitevasionpersistence

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks