Overview

overview

8

Static

static

1

03542599.exe

windows7-x64

8

03542599.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03542599.exe

  • Size

    1.5MB

  • Sample

    230612-rpks1ace39

  • MD5

    858ee6ceb590822f57d2d98a32e3c5af

  • SHA1

    0cd9e539e919dd0367c1d04e2644bc3e8ad109e5

  • SHA256

    3d505dd5081824da4517fbdc2a4da8c6133538b72171e260f59d10be5ed20acb

  • SHA512

    ad624bba251a6131471a662e31a676c6facb335aef433b0c2313adb57c2ca4701590845c3c237d190a1817fa43daeaaeb3731c91e19045691523cccf9cbbd198

  • SSDEEP

    24576:AD1YS7FpyUxT3DC2O1zj1SqdAGFQZIxvC45UJoenm9x:TQ5xT3DDWzjYq+ZIxL5UJoew

Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      03542599.exe

    • Size

      1.5MB

    • MD5

      858ee6ceb590822f57d2d98a32e3c5af

    • SHA1

      0cd9e539e919dd0367c1d04e2644bc3e8ad109e5

    • SHA256

      3d505dd5081824da4517fbdc2a4da8c6133538b72171e260f59d10be5ed20acb

    • SHA512

      ad624bba251a6131471a662e31a676c6facb335aef433b0c2313adb57c2ca4701590845c3c237d190a1817fa43daeaaeb3731c91e19045691523cccf9cbbd198

    • SSDEEP

      24576:AD1YS7FpyUxT3DC2O1zj1SqdAGFQZIxvC45UJoenm9x:TQ5xT3DDWzjYq+ZIxL5UJoew

    Score
    8/10
    bootkitdiscoverypersistence

    • Downloads MZ/PE file

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks