d99d636a4371981f331ad476b4cdd29861933b671810934befda8459434e722a | Triage

Submit
Reports

Overview

overview

Static

static

1

d99d636a43...2a.exe

windows7-x64

d99d636a43...2a.exe

windows10-2004-x64

7

Sharing

General

Target

d99d636a4371981f331ad476b4cdd29861933b671810934befda8459434e722a
Size

159KB
Sample

221128-flwkjsgb26
MD5

f40b3e21fd1b9a3874af4dc473d3274d
SHA1

83adc3b59966c83ec8bf65d6f12e358e9e4fc1df
SHA256

d99d636a4371981f331ad476b4cdd29861933b671810934befda8459434e722a
SHA512

816bf66db404397c54be82cf4ca358be6c45ea9789d6950748b263bc4e1337f483e99a9c6e71d2ab073bdcaee676cfbb0b9553b335c4b5dbdbe6b4ddd746d59f
SSDEEP

3072:l3c1fP4AJJrXlF4jPktdwAliX+f+chDKUDVdFKyTgCAZtiYpzUqB+Ow:ROPjnlGPk/f46RRVdTuzUqBe

Score

10^/10

bootkit discovery persistence phishing upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

d99d636a4371981f331ad476b4cdd29861933b671810934befda8459434e722a.exe

Resource

win7-20220812-en

bootkit discovery persistence phishing upx

windows7-x64

23 signatures

150 seconds

Behavioral task

behavioral2

Sample

d99d636a4371981f331ad476b4cdd29861933b671810934befda8459434e722a.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  d99d636a4371981f331ad476b4cdd29861933b671810934befda8459434e722a
- Size
  
  159KB
- MD5
  
  f40b3e21fd1b9a3874af4dc473d3274d
- SHA1
  
  83adc3b59966c83ec8bf65d6f12e358e9e4fc1df
- SHA256
  
  d99d636a4371981f331ad476b4cdd29861933b671810934befda8459434e722a
- SHA512
  
  816bf66db404397c54be82cf4ca358be6c45ea9789d6950748b263bc4e1337f483e99a9c6e71d2ab073bdcaee676cfbb0b9553b335c4b5dbdbe6b4ddd746d59f
- SSDEEP
  
  3072:l3c1fP4AJJrXlF4jPktdwAliX+f+chDKUDVdFKyTgCAZtiYpzUqB+Ow:ROPjnlGPk/f46RRVdTuzUqBe
Score

10^/10

bootkit discovery persistence phishing upx
- Detected phishing page
  phishing
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistencephishingupx

behavioral2

© 2018-2024

Terms | Privacy