b957227f40a5fbbaa859bd776259fe52435b5e0f314d389fc3a446be830e34ee | Triage

Sharing

General

Target

b957227f40a5fbbaa859bd776259fe52435b5e0f314d389fc3a446be830e34ee
Size

840KB
Sample

221203-hblcyacd26
MD5

29e62ed5e9305eb70d226c4f47b64c00
SHA1

bdcc011025964a33492835b3e9e185f5781b5168
SHA256

b957227f40a5fbbaa859bd776259fe52435b5e0f314d389fc3a446be830e34ee
SHA512

377f766d944951cfea450f1e026dbefbf4877c76b9288f723eab53cc0ee61822e74acdad8e3e0d4015d5c1a000c7930148dbe98f64d7221621ced83c3bb15a5b
SSDEEP

24576:Ack8763k8wIn5poyURgsu0x9nGo0vv1/zPNIGy:Ank815pCRgsu0x9Go0vt/zPHy

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  b957227f40a5fbbaa859bd776259fe52435b5e0f314d389fc3a446be830e34ee
- Size
  
  840KB
- MD5
  
  29e62ed5e9305eb70d226c4f47b64c00
- SHA1
  
  bdcc011025964a33492835b3e9e185f5781b5168
- SHA256
  
  b957227f40a5fbbaa859bd776259fe52435b5e0f314d389fc3a446be830e34ee
- SHA512
  
  377f766d944951cfea450f1e026dbefbf4877c76b9288f723eab53cc0ee61822e74acdad8e3e0d4015d5c1a000c7930148dbe98f64d7221621ced83c3bb15a5b
- SSDEEP
  
  24576:Ack8763k8wIn5poyURgsu0x9nGo0vv1/zPNIGy:Ank815pCRgsu0x9Go0vt/zPHy
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence