ffcd284dd3f33ba4861dab647aaab24b929fc582df1759e711fcb1695960a0d4

Target

Screenshot 2023-05-04 8.24.42 AM.png
Size

27KB
Sample

230504-try5hsfe31
MD5

00f570c756caab8c20ecabdc996c69d3
SHA1

88d2f10c67a4566478e9b2ceddd52cac9b5fdb3b
SHA256

ffcd284dd3f33ba4861dab647aaab24b929fc582df1759e711fcb1695960a0d4
SHA512

f5013ce3427447a2107a205a4f8c85b764e5dfe9543381881aa4ea6afaf8967c7ed813ebc5de06f602940b054f2edbe6d11858b8858c25d6dab921232ae3f49d
SSDEEP

768:gAAAAdwBgjVNFfZhHhzG+sXrwTOw9KxLgzZV4Kqc9Eu:gAAAAdwB4nFfZhBO7XbeZ6KquEu

Score

8^/10

Malware Config

Targets

- Target
  
  Screenshot 2023-05-04 8.24.42 AM.png
- Size
  
  27KB
- MD5
  
  00f570c756caab8c20ecabdc996c69d3
- SHA1
  
  88d2f10c67a4566478e9b2ceddd52cac9b5fdb3b
- SHA256
  
  ffcd284dd3f33ba4861dab647aaab24b929fc582df1759e711fcb1695960a0d4
- SHA512
  
  f5013ce3427447a2107a205a4f8c85b764e5dfe9543381881aa4ea6afaf8967c7ed813ebc5de06f602940b054f2edbe6d11858b8858c25d6dab921232ae3f49d
- SSDEEP
  
  768:gAAAAdwBgjVNFfZhHhzG+sXrwTOw9KxLgzZV4Kqc9Eu:gAAAAdwB4nFfZhBO7XbeZ6KquEu
Score

8^/10

bootkit discovery evasion exploit persistence upx
- Disables Task Manager via registry modification
  evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Modifies boot configuration data using bcdedit
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Disables Task Manager via registry modification

Possible privilege escalation attempt

Executes dropped EXE

Modifies file permissions

UPX packed file

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Modifies boot configuration data using bcdedit

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2