c2d29eae29b580373b1f7cdf9635370f686aadf586c811d5b6001441b4008ade | Triage

Sharing

General

Target

c2d29eae29b580373b1f7cdf9635370f686aadf586c811d5b6001441b4008ade
Size

800KB
Sample

221203-gd1d7shg73
MD5

de2c1bb63f0fa987dbec935844797fbd
SHA1

8708d0132d781dfc664e96f734e8e716bbfadee0
SHA256

c2d29eae29b580373b1f7cdf9635370f686aadf586c811d5b6001441b4008ade
SHA512

9f505eda26c65bacdb2231f82da8b4438d29fad62689fa3dc9f439af80b3315217f0b0fa147ed203c6b05abe567d429ba9a40ab35315dc4b6e0ae443b92390fc
SSDEEP

24576:jLQQlvrcr3O5I0ZTF9H4v2fVYuPeOgvj8e8+w+7n:Xncr+pvqqjWlYe4

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  
  c2d29eae29b580373b1f7cdf9635370f686aadf586c811d5b6001441b4008ade
- Size
  
  800KB
- MD5
  
  de2c1bb63f0fa987dbec935844797fbd
- SHA1
  
  8708d0132d781dfc664e96f734e8e716bbfadee0
- SHA256
  
  c2d29eae29b580373b1f7cdf9635370f686aadf586c811d5b6001441b4008ade
- SHA512
  
  9f505eda26c65bacdb2231f82da8b4438d29fad62689fa3dc9f439af80b3315217f0b0fa147ed203c6b05abe567d429ba9a40ab35315dc4b6e0ae443b92390fc
- SSDEEP
  
  24576:jLQQlvrcr3O5I0ZTF9H4v2fVYuPeOgvj8e8+w+7n:Xncr+pvqqjWlYe4
Score

6^/10

bootkit persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence