Triage | Malware sandboxing report by Hatching Triage

Sharing

General

Target

kaspersky4win202121.9.6.465es_37946.exe
Size

3MB
Sample

230324-26kvfahh88
MD5

6f3653a401e3dfd802d9c69f20c9a8ac
SHA1

db0937b5b5adfc72cb5291f28f08cb234da9d740
SHA256

857db21d0ca383968700b5397ded7bc1b336209e4464c46e479668f08e067495
SHA512

8e5b1fafaf331e3d8bd2ded041a2f9fe5d6542d8be63bb823e05631cd5ebe89d85de1685c11431d01c010c866061b58d7d587cfa28edaf9c83f71091160c0d81
SSDEEP

98304:gQFKOoWJ9QennbKgb/LcPOc/KmCPOHxFvSeVEQaJU7pByrcGw:ToWfQenzbDcGc2mfJtm

Score

8^/10

bootkit evasion persistence trojan

Malware Config

Targets

- Target
  
  kaspersky4win202121.9.6.465es_37946.exe
- Size
  
  3MB
- MD5
  
  6f3653a401e3dfd802d9c69f20c9a8ac
- SHA1
  
  db0937b5b5adfc72cb5291f28f08cb234da9d740
- SHA256
  
  857db21d0ca383968700b5397ded7bc1b336209e4464c46e479668f08e067495
- SHA512
  
  8e5b1fafaf331e3d8bd2ded041a2f9fe5d6542d8be63bb823e05631cd5ebe89d85de1685c11431d01c010c866061b58d7d587cfa28edaf9c83f71091160c0d81
- SSDEEP
  
  98304:gQFKOoWJ9QennbKgb/LcPOc/KmCPOHxFvSeVEQaJU7pByrcGw:ToWfQenzbDcGc2mfJtm
Score

8^/10

bootkit evasion persistence trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

T1112

Install Root Certificate

Discovery

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Bootkit

T1067

Privilege Escalation

Tasks

static1

behavioral1

bootkitevasionpersistencetrojan

behavioral2

bootkitevasionpersistencetrojan