b79be369bd7a869202d7d86ffdce0921d002c6b85bb602a25db269fd7a9ee688 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

avast_free_antivirus_setup_online.exe
Size

257KB
Sample

230717-2tf1qafb24
MD5

30981ba1fa19cffe239ba100079960e2
SHA1

171904ee005f285ca84f8fb145a2d0e35195260d
SHA256

b79be369bd7a869202d7d86ffdce0921d002c6b85bb602a25db269fd7a9ee688
SHA512

b3747f9381e16400ad29cf050714fd916b1bb179401b1b5af6588b166e38285903efc52fdccd1034a3329a654a03621078ca2c0ecd39abb5d0f146ceec7287a1
SSDEEP

3072:c2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCozOhhOn+TR:c0KgGwHqwOOELha+sm2D2+Uhnguf+

Score

8^/10

bootkit persistence

Malware Config

Targets

- Target
  
  avast_free_antivirus_setup_online.exe
- Size
  
  257KB
- MD5
  
  30981ba1fa19cffe239ba100079960e2
- SHA1
  
  171904ee005f285ca84f8fb145a2d0e35195260d
- SHA256
  
  b79be369bd7a869202d7d86ffdce0921d002c6b85bb602a25db269fd7a9ee688
- SHA512
  
  b3747f9381e16400ad29cf050714fd916b1bb179401b1b5af6588b166e38285903efc52fdccd1034a3329a654a03621078ca2c0ecd39abb5d0f146ceec7287a1
- SSDEEP
  
  3072:c2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCozOhhOn+TR:c0KgGwHqwOOELha+sm2D2+Uhnguf+
Score

8^/10

bootkit persistence
- Downloads MZ/PE file
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

Security Software Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitpersistence