Overview

overview

7

Static

static

1

startup.exe

windows7-x64

7

Resubmissions

03-04-2023 00:23

230403-apg9fadb5t 7

03-04-2023 00:17

230403-ak6fgabg65 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    startup.exe

  • Size

    3.9MB

  • Sample

    230403-apg9fadb5t

  • MD5

    f9d653cfd59bf94924d5e5de664d9551

  • SHA1

    e77cf1a565322a026802fb7333bca2714f42ee4d

  • SHA256

    74ae420d08ac07c20d205b449896aee75926c45c6236608463710a5a01c1644f

  • SHA512

    1ad65b059b2a6e5e6ce8601977472fd23e562956de0929302e2fc445417498b5cb9abb43fffd8ada52fbcc04c9b783bbd7fef09c939401e1b218914884b87ea4

  • SSDEEP

    98304:2INSsMuJIh61BCmK8S9u5fOlvXXdRE4Y6dtKGqTe8ot:L1Q6nCmKp1XX3M63eyrt

Score
7/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      startup.exe

    • Size

      3.9MB

    • MD5

      f9d653cfd59bf94924d5e5de664d9551

    • SHA1

      e77cf1a565322a026802fb7333bca2714f42ee4d

    • SHA256

      74ae420d08ac07c20d205b449896aee75926c45c6236608463710a5a01c1644f

    • SHA512

      1ad65b059b2a6e5e6ce8601977472fd23e562956de0929302e2fc445417498b5cb9abb43fffd8ada52fbcc04c9b783bbd7fef09c939401e1b218914884b87ea4

    • SSDEEP

      98304:2INSsMuJIh61BCmK8S9u5fOlvXXdRE4Y6dtKGqTe8ot:L1Q6nCmKp1XX3M63eyrt

    Score
    7/10
    bootkitevasionpersistencetrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks