9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d | Triage

Sharing

General

Target

PowerPoint.exe
Size

136KB
Sample

230324-agcnzsba37
MD5

70108103a53123201ceb2e921fcfe83c
SHA1

c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA256

9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512

996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
SSDEEP

1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD

Score

7^/10

bootkit persistence

Malware Config

Targets

- Target
  
  PowerPoint.exe
- Size
  
  136KB
- MD5
  
  70108103a53123201ceb2e921fcfe83c
- SHA1
  
  c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
- SHA256
  
  9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
- SHA512
  
  996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
- SSDEEP
  
  1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD
Score

7^/10

bootkit persistence
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence