a5483a5fd7f3db1e72fddabb2be6512dba469a9f87deb33c995f2b649a8516c9 | Triage

Sharing

General

Target

a5483a5fd7f3db1e72fddabb2be6512dba469a9f87deb33c995f2b649a8516c9
Size

820KB
Sample

221129-ejy28agd2s
MD5

bb1e5bfa7a9e9e760fc36ec16ce32e4c
SHA1

10e7cf6ef27ccf6a3439f701f4da35a2b91224e1
SHA256

a5483a5fd7f3db1e72fddabb2be6512dba469a9f87deb33c995f2b649a8516c9
SHA512

5f3cc2754aabef0cd5dcfb1d359a3e38e93ca4d0e995e5816a231ed654c2a5ce2cd08b03bf1132ac53104e1fb6b70f0ee24a223bb008514afb9c853c94ff00e1
SSDEEP

24576:jR9nc5vuj6aKNzRp7EQDrOUVmY0Pd1U3cZOWp:jRlcN3NlJvDrOUVEPfZOWp

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  a5483a5fd7f3db1e72fddabb2be6512dba469a9f87deb33c995f2b649a8516c9
- Size
  
  820KB
- MD5
  
  bb1e5bfa7a9e9e760fc36ec16ce32e4c
- SHA1
  
  10e7cf6ef27ccf6a3439f701f4da35a2b91224e1
- SHA256
  
  a5483a5fd7f3db1e72fddabb2be6512dba469a9f87deb33c995f2b649a8516c9
- SHA512
  
  5f3cc2754aabef0cd5dcfb1d359a3e38e93ca4d0e995e5816a231ed654c2a5ce2cd08b03bf1132ac53104e1fb6b70f0ee24a223bb008514afb9c853c94ff00e1
- SSDEEP
  
  24576:jR9nc5vuj6aKNzRp7EQDrOUVmY0Pd1U3cZOWp:jRlcN3NlJvDrOUVEPfZOWp
Score

6^/10

bootkit persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence