9ba5c4f0257e507ff6e841013401d77ff3b1d3a63a41c2dfdb4fe9a57a88eac9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9ba5c4f0257e507ff6e841013401d77ff3b1d3a63a41c2dfdb4fe9a57a88eac9
Size

840KB
Sample

221129-e8256sac6w
MD5

272d3231049d381a09d009f101c07b40
SHA1

452486b04dc2da20ae26511eddd5da243f28cc91
SHA256

9ba5c4f0257e507ff6e841013401d77ff3b1d3a63a41c2dfdb4fe9a57a88eac9
SHA512

60f4a69cfe9efda8b7cd305c22522b4deee66e16807028c652b46a619d02eb53db39df341900cb728bfb2210dabcc08e7d05c991119f4413f7ac12d776e4a61f
SSDEEP

12288:ckolW+pPv+AsOQSH1u/eHnJELfdiKSGeW/7B3O1m1l2bDi5ozUinkL:RoECPmAbsEnyLVMYBdl2bDi6QqkL

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  9ba5c4f0257e507ff6e841013401d77ff3b1d3a63a41c2dfdb4fe9a57a88eac9
- Size
  
  840KB
- MD5
  
  272d3231049d381a09d009f101c07b40
- SHA1
  
  452486b04dc2da20ae26511eddd5da243f28cc91
- SHA256
  
  9ba5c4f0257e507ff6e841013401d77ff3b1d3a63a41c2dfdb4fe9a57a88eac9
- SHA512
  
  60f4a69cfe9efda8b7cd305c22522b4deee66e16807028c652b46a619d02eb53db39df341900cb728bfb2210dabcc08e7d05c991119f4413f7ac12d776e4a61f
- SSDEEP
  
  12288:ckolW+pPv+AsOQSH1u/eHnJELfdiKSGeW/7B3O1m1l2bDi5ozUinkL:RoECPmAbsEnyLVMYBdl2bDi6QqkL
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence