Triage | Malware sandboxing report by Hatching Triage

Sharing

General

Target

8da9e6d81d1c75f2096569cf7fbb0aac9935973bfd1a07224872a5e4751ab3a6
Size

31MB
Sample

230327-jhrzqsed5s
MD5

725ca74f7130d31b4c39c36d069b9795
SHA1

d13350b16df10edf2fdfa14b2b0e755d4c88e1a1
SHA256

8da9e6d81d1c75f2096569cf7fbb0aac9935973bfd1a07224872a5e4751ab3a6
SHA512

2dd5fc3ac723b1a4a6926f8333a90af9217b78255ae21cfd7928dca6dc20c952d2302b5d3097bce4adab857540ab475136dadcbe97244bd598509f79601eedf8
SSDEEP

786432:VlT7NPyLNCgGeoKA/OdTYEgW4eJopfW9Pj9o3Tp:VlT7dcDzohOdzgZQhC

Score

7^/10

bootkit persistence

Malware Config

Targets

- Target
  
  8da9e6d81d1c75f2096569cf7fbb0aac9935973bfd1a07224872a5e4751ab3a6
- Size
  
  31MB
- MD5
  
  725ca74f7130d31b4c39c36d069b9795
- SHA1
  
  d13350b16df10edf2fdfa14b2b0e755d4c88e1a1
- SHA256
  
  8da9e6d81d1c75f2096569cf7fbb0aac9935973bfd1a07224872a5e4751ab3a6
- SHA512
  
  2dd5fc3ac723b1a4a6926f8333a90af9217b78255ae21cfd7928dca6dc20c952d2302b5d3097bce4adab857540ab475136dadcbe97244bd598509f79601eedf8
- SSDEEP
  
  786432:VlT7NPyLNCgGeoKA/OdTYEgW4eJopfW9Pj9o3Tp:VlT7dcDzohOdzgZQhC
Score

7^/10

bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Query Registry

T1012

System Information Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Bootkit

T1067

Privilege Escalation

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence