eead43b3b20cf5a8542ffb61a70a3dc45ea54bac1573538e7143ea10f0a94660 | Triage

Sharing

General

Target

eead43b3b20cf5a8542ffb61a70a3dc45ea54bac1573538e7143ea10f0a94660
Size

904KB
Sample

221206-22rr7afc31
MD5

93799bad9a3ce0b1f3b41ab006d86d7c
SHA1

8362b5a5523763b945746e34b44f33d247acae6d
SHA256

eead43b3b20cf5a8542ffb61a70a3dc45ea54bac1573538e7143ea10f0a94660
SHA512

9ebbba81b7636636f4426a516cbddf48f88796090d0e25296d234204b6e9befd306dd54a90612b7c1d5a88da68651b940c7cbb3c51368a480d3d33c2a27d9da6
SSDEEP

24576:yb8NrhwLjVz0g8boR4Mfzlf7zPgi0BVY:yb8NrhQqba4Mfzlf7Lz0BV

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  eead43b3b20cf5a8542ffb61a70a3dc45ea54bac1573538e7143ea10f0a94660
- Size
  
  904KB
- MD5
  
  93799bad9a3ce0b1f3b41ab006d86d7c
- SHA1
  
  8362b5a5523763b945746e34b44f33d247acae6d
- SHA256
  
  eead43b3b20cf5a8542ffb61a70a3dc45ea54bac1573538e7143ea10f0a94660
- SHA512
  
  9ebbba81b7636636f4426a516cbddf48f88796090d0e25296d234204b6e9befd306dd54a90612b7c1d5a88da68651b940c7cbb3c51368a480d3d33c2a27d9da6
- SSDEEP
  
  24576:yb8NrhwLjVz0g8boR4Mfzlf7zPgi0BVY:yb8NrhQqba4Mfzlf7Lz0BV
Score

8^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence