Overview

overview

10

Static

static

66865a336b...8b.exe

windows7-x64

10

66865a336b...8b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    66865a336b40ca837ada30f0700e7d19d3f7ddaeea70376739d69cf76b90e58b

  • Size

    2.9MB

  • Sample

    221201-zhj7wshh87

  • MD5

    355a4f0c9c52468845459ba5b7a6b766

  • SHA1

    c5b738bdf17f4effd6fd7ac80f2bd048413041c9

  • SHA256

    66865a336b40ca837ada30f0700e7d19d3f7ddaeea70376739d69cf76b90e58b

  • SHA512

    4bb7ec4b85e646e3b417da1ba4f1ae7eac72fe7d35cdec55364452b0afea97b65a223f696ba2108e29b5b8e4f3acf658feec1087da0102066df3bd134a5419df

  • SSDEEP

    24576:e3AJV0uTrsRypLQGBXSwOEbW+i1EtUTrZ8AliemTKr+HqXL4N9fu6yAN4N9oIA4j:m0t3BS7+iutuwfurXoWXLP

Score
10/10
bootkitevasionpersistence

Malware Config

Targets

    • Target

      66865a336b40ca837ada30f0700e7d19d3f7ddaeea70376739d69cf76b90e58b

    • Size

      2.9MB

    • MD5

      355a4f0c9c52468845459ba5b7a6b766

    • SHA1

      c5b738bdf17f4effd6fd7ac80f2bd048413041c9

    • SHA256

      66865a336b40ca837ada30f0700e7d19d3f7ddaeea70376739d69cf76b90e58b

    • SHA512

      4bb7ec4b85e646e3b417da1ba4f1ae7eac72fe7d35cdec55364452b0afea97b65a223f696ba2108e29b5b8e4f3acf658feec1087da0102066df3bd134a5419df

    • SSDEEP

      24576:e3AJV0uTrsRypLQGBXSwOEbW+i1EtUTrZ8AliemTKr+HqXL4N9fu6yAN4N9oIA4j:m0t3BS7+iutuwfurXoWXLP

    Score
    10/10
    bootkitevasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Modifies WinLogon

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks