dca7b5cb407c13a9b5cafa6d22bc7cc04cac9d33b0c9eb9588c43ebb672cc39f | Triage

Sharing

General

Target

dca7b5cb407c13a9b5cafa6d22bc7cc04cac9d33b0c9eb9588c43ebb672cc39f
Size

148KB
Sample

221206-2kjp9aah54
MD5

200f8b15cce07e635b937c913c8e6456
SHA1

8fdb906cb29c153df82fbd4925924c66ea39db62
SHA256

dca7b5cb407c13a9b5cafa6d22bc7cc04cac9d33b0c9eb9588c43ebb672cc39f
SHA512

46bfa8a4e3cf8ed23f80b4807cdbf57c0838679835b5d54db817474de65373eb236c289dcd87073700252bd26ad5bd42736197199ae22ba376a932cb90ed485c
SSDEEP

3072:hri717vQ3XaAfFmLrdIFYmcSggHtldkW15+tjZZqTwyGBhVJ/XjviJvf:xI17vQ3X0rVmcSggHN1ctjjq87hVsv

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  dca7b5cb407c13a9b5cafa6d22bc7cc04cac9d33b0c9eb9588c43ebb672cc39f
- Size
  
  148KB
- MD5
  
  200f8b15cce07e635b937c913c8e6456
- SHA1
  
  8fdb906cb29c153df82fbd4925924c66ea39db62
- SHA256
  
  dca7b5cb407c13a9b5cafa6d22bc7cc04cac9d33b0c9eb9588c43ebb672cc39f
- SHA512
  
  46bfa8a4e3cf8ed23f80b4807cdbf57c0838679835b5d54db817474de65373eb236c289dcd87073700252bd26ad5bd42736197199ae22ba376a932cb90ed485c
- SSDEEP
  
  3072:hri717vQ3XaAfFmLrdIFYmcSggHtldkW15+tjZZqTwyGBhVJ/XjviJvf:xI17vQ3X0rVmcSggHN1ctjjq87hVsv
Score

8^/10

persistence bootkit
- Blocklisted process makes network request
- Sets service image path in registry
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

bootkitpersistence