8700e903754a00c6cf444f1c437e2944d72887310c11199ccda97b0e9517a876 | Triage

Sharing

General

Target

GLP_installer_900223150_market.exe
Size

3.6MB
Sample

231014-yn6seabh4z
MD5

e7f4d560e7520eb427eddb72cb645344
SHA1

8b9c624f90f150ea10fe5eac0d219be2d719280d
SHA256

8700e903754a00c6cf444f1c437e2944d72887310c11199ccda97b0e9517a876
SHA512

cfe7dfae8333d9d8320b0915abdd6d7da921c60a9d4b702568df39fc2fcac7fa1f3efe0c258d2e163a1f2b8e12426c333029eb7bbefc8e147f2c472466ed7532
SSDEEP

49152:608OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJXe9emEPGKOPkQThMYRMnm7LB6:608vdsGaQNgS1C6e6ngKpq+

Score

9^/10

bootkit discovery evasion persistence ransomware

Malware Config

Targets

- Target
  
  GLP_installer_900223150_market.exe
- Size
  
  3.6MB
- MD5
  
  e7f4d560e7520eb427eddb72cb645344
- SHA1
  
  8b9c624f90f150ea10fe5eac0d219be2d719280d
- SHA256
  
  8700e903754a00c6cf444f1c437e2944d72887310c11199ccda97b0e9517a876
- SHA512
  
  cfe7dfae8333d9d8320b0915abdd6d7da921c60a9d4b702568df39fc2fcac7fa1f3efe0c258d2e163a1f2b8e12426c333029eb7bbefc8e147f2c472466ed7532
- SSDEEP
  
  49152:608OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJXe9emEPGKOPkQThMYRMnm7LB6:608vdsGaQNgS1C6e6ngKpq+
Score

9^/10

bootkit persistence discovery evasion ransomware
- Renames multiple (83) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2

bootkitdiscoveryevasionpersistenceransomware