bb809d371b3bb4313853cfd9579a6457624161d9cbfb2a612f9b54d0b15b20af | Triage

Sharing

General

Target

bb809d371b3bb4313853cfd9579a6457624161d9cbfb2a612f9b54d0b15b20af
Size

838KB
Sample

221203-g4g1jsbg22
MD5

d23c39233f67f2ce25dd1d85ad27e03b
SHA1

18dae6a907dae23d5507a8de4a320673793af7b9
SHA256

bb809d371b3bb4313853cfd9579a6457624161d9cbfb2a612f9b54d0b15b20af
SHA512

b53d4bba48f9228021c78cb611d07b1843f76ee4d6852d7cf5114a423b294edbc61a194130a49007ea98dea750acf6d633db687a9b4f2d0a7fa4fedc4c857b11
SSDEEP

24576:yE/81/FQ3VskTRgznnLsu2VFbbflBpIRRiw:yEq/FKaK8nnLaFffl

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  bb809d371b3bb4313853cfd9579a6457624161d9cbfb2a612f9b54d0b15b20af
- Size
  
  838KB
- MD5
  
  d23c39233f67f2ce25dd1d85ad27e03b
- SHA1
  
  18dae6a907dae23d5507a8de4a320673793af7b9
- SHA256
  
  bb809d371b3bb4313853cfd9579a6457624161d9cbfb2a612f9b54d0b15b20af
- SHA512
  
  b53d4bba48f9228021c78cb611d07b1843f76ee4d6852d7cf5114a423b294edbc61a194130a49007ea98dea750acf6d633db687a9b4f2d0a7fa4fedc4c857b11
- SSDEEP
  
  24576:yE/81/FQ3VskTRgznnLsu2VFbbflBpIRRiw:yEq/FKaK8nnLaFffl
Score

6^/10

bootkit persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence