Overview

overview

10

Static

static

1

b95b959e6c...4b.exe

windows7-x64

10

b95b959e6c...4b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b95b959e6c4a12ab1f7972ea7a167e25bbb2d1edaf2df6d8c07c1c48fd5ddb4b

  • Size

    158KB

  • Sample

    221128-flvcgscb4x

  • MD5

    7c4d2e6a8591d0b60405ac58d80cf019

  • SHA1

    e4ae347097be9d748ed492ab12faef30a0eca7ad

  • SHA256

    b95b959e6c4a12ab1f7972ea7a167e25bbb2d1edaf2df6d8c07c1c48fd5ddb4b

  • SHA512

    17424e73ad67bc83f011b955fa608b8834877d6005058c955714fef5ca33e8d7a2afcd18a1bd2b4a3f7c0f8488ab20d8fb9a3e367aac05eade15a3f4d88dda1b

  • SSDEEP

    3072:f3c1fP4AJJiiYZjg7typOMmjFELOfUa2gAxV2Zbkgd2btq7NE/P7:/OPjfEMyp/i8XgAzVgdPa/P7

Score
10/10
bootkitdiscoverypersistencephishingupx

Malware Config

Targets

    • Target

      b95b959e6c4a12ab1f7972ea7a167e25bbb2d1edaf2df6d8c07c1c48fd5ddb4b

    • Size

      158KB

    • MD5

      7c4d2e6a8591d0b60405ac58d80cf019

    • SHA1

      e4ae347097be9d748ed492ab12faef30a0eca7ad

    • SHA256

      b95b959e6c4a12ab1f7972ea7a167e25bbb2d1edaf2df6d8c07c1c48fd5ddb4b

    • SHA512

      17424e73ad67bc83f011b955fa608b8834877d6005058c955714fef5ca33e8d7a2afcd18a1bd2b4a3f7c0f8488ab20d8fb9a3e367aac05eade15a3f4d88dda1b

    • SSDEEP

      3072:f3c1fP4AJJiiYZjg7typOMmjFELOfUa2gAxV2Zbkgd2btq7NE/P7:/OPjfEMyp/i8XgAzVgdPa/P7

    Score
    10/10
    bootkitdiscoverypersistencephishingupx

    • Detected phishing page

      phishing

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks