Triage | Malware sandboxing report by Hatching Triage

Sharing

General

Target

https://github.com/fabrimagic72/malware-samples
Sample

230327-mgr5wsfa8w

Score

7^/10

bootkit persistence

Malware Config

Targets

- Target
  
  https://github.com/fabrimagic72/malware-samples
Score

7^/10

bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Web Service

Discovery

Query Registry

T1012

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Bootkit

T1067

Privilege Escalation

Tasks

static1

urlscan1

behavioral1

bootkitpersistence