Overview

overview

8

Static

static

8

bc3c5c7c49...4c.exe

windows7-x64

8

bc3c5c7c49...4c.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc3c5c7c49c8302fd37645c5d0d10f69de58f505f4ee5bdd905c614f454e884c

  • Size

    955KB

  • Sample

    221205-jbeqtsgg96

  • MD5

    cc76fcd37dd6f03695d5694663d80244

  • SHA1

    f9bf804450588eb901da4695b56a5cfca7ced30b

  • SHA256

    bc3c5c7c49c8302fd37645c5d0d10f69de58f505f4ee5bdd905c614f454e884c

  • SHA512

    04ca471f765f39b15ce8abf492ac0eb588165235d93129bc2984c9d47633222c874eca0bd84715f2f7de97f30498ffb4abdb06e9c8be581f702e7706c8423850

  • SSDEEP

    24576:IomTxnzOO+U5JJw6Z7dcasgCRcJXR0zSjrzDIPtf8B:ZOxCQ5Dw2mgCuJXRqYrX2tf

Score
8/10
bootkitpersistenceupx

Malware Config

Targets

    • Target

      bc3c5c7c49c8302fd37645c5d0d10f69de58f505f4ee5bdd905c614f454e884c

    • Size

      955KB

    • MD5

      cc76fcd37dd6f03695d5694663d80244

    • SHA1

      f9bf804450588eb901da4695b56a5cfca7ced30b

    • SHA256

      bc3c5c7c49c8302fd37645c5d0d10f69de58f505f4ee5bdd905c614f454e884c

    • SHA512

      04ca471f765f39b15ce8abf492ac0eb588165235d93129bc2984c9d47633222c874eca0bd84715f2f7de97f30498ffb4abdb06e9c8be581f702e7706c8423850

    • SSDEEP

      24576:IomTxnzOO+U5JJw6Z7dcasgCRcJXR0zSjrzDIPtf8B:ZOxCQ5Dw2mgCuJXRqYrX2tf

    Score
    8/10
    bootkitpersistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks