Overview

overview

8

Static

static

1

0f08d94115...e5.exe

windows7-x64

8

0f08d94115...e5.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f08d941155f5f2043b91877c698481d8e53404a8cde17a3e5a8a82a936404e5

  • Size

    256KB

  • Sample

    221127-lxb8yage86

  • MD5

    69b0d3aabd5a2f465cbedf13f19dd81f

  • SHA1

    93bd7f741cefabb15a63ebf31e414ba4fa6d9132

  • SHA256

    0f08d941155f5f2043b91877c698481d8e53404a8cde17a3e5a8a82a936404e5

  • SHA512

    ebf984654af6d41d5d015bbd28b9723a7b96614e4b2e59342dcc9ab1c02c9e779742ca54fe08bbd3939a1afb8ae47e4c390b6baf9b62199b853418ff919bac69

  • SSDEEP

    6144:jTq+IFjIs5taZGuQ25icmlGYCEpFgmNhzwWgd:fy5viZGuQ2JmoEpFxj0

Score
8/10
bootkitdiscoverypersistenceupx

Malware Config

Targets

    • Target

      0f08d941155f5f2043b91877c698481d8e53404a8cde17a3e5a8a82a936404e5

    • Size

      256KB

    • MD5

      69b0d3aabd5a2f465cbedf13f19dd81f

    • SHA1

      93bd7f741cefabb15a63ebf31e414ba4fa6d9132

    • SHA256

      0f08d941155f5f2043b91877c698481d8e53404a8cde17a3e5a8a82a936404e5

    • SHA512

      ebf984654af6d41d5d015bbd28b9723a7b96614e4b2e59342dcc9ab1c02c9e779742ca54fe08bbd3939a1afb8ae47e4c390b6baf9b62199b853418ff919bac69

    • SSDEEP

      6144:jTq+IFjIs5taZGuQ25icmlGYCEpFgmNhzwWgd:fy5viZGuQ2JmoEpFxj0

    Score
    8/10
    bootkitdiscoverypersistenceupx

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks