Overview

overview

7

Static

static

1

Endermanch...nt.exe

windows10-1703-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PowerPoint.zip

  • Size

    66KB

  • Sample

    230331-18ssdsfc5y

  • MD5

    196611c89b3b180d8a638d11d50926ed

  • SHA1

    aa98b312dc0e9d7e59bef85b704ad87dc6c582d5

  • SHA256

    4c10d3ddeba414775ebb5af4da5b7bb17ae52a92831fe09244f63c36b2c77f34

  • SHA512

    19d60abf83b4a4fe5701e38e0c84f9492232ceb95b267ae5859c049cea12fee2328a5d26ffd850e38307fb10cb3955b7e5e49d916856c929442d45b87071d724

  • SSDEEP

    1536:bnTpZDj+PE7ixJWt6/RXHNrqCRRSc5si4YJ5lyf1FDwTqV:npt2E7ix9Fp1qcCZI7yfa2

Score
7/10
bootkitpersistence

Malware Config

Targets

    • Target

      Endermanch@PowerPoint.exe

    • Size

      136KB

    • MD5

      70108103a53123201ceb2e921fcfe83c

    • SHA1

      c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

    • SHA256

      9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

    • SHA512

      996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

    • SSDEEP

      1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD

    Score
    7/10
    bootkitpersistence

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks