Overview

overview

10

Static

static

7

193a2f1f58...7a.exe

windows7-x64

10

193a2f1f58...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    193a2f1f586f5966a670c0cebdcd767a

  • Size

    510KB

  • Sample

    231230-p7enlachbp

  • MD5

    193a2f1f586f5966a670c0cebdcd767a

  • SHA1

    80747541e667065c5224e45858147b9491af5106

  • SHA256

    d5eb64a4299bc489d0e73aa95dd4bab67212169e1868137cba6654171f58f9fd

  • SHA512

    9e7f7e7b33fc5784be755874324344e45a05a85300c81f77ac881b9f526b436c847a8928e33d4ec2259d8c9e7254ac83fe24bd0405f37d4c3eaa3a2d6390f996

  • SSDEEP

    12288:qsMxi+i/NBzYLJpjJICcfkmOjuXCjhpehUNtTird:qsMxwNBkOf6jyIehETEd

Score
10/10
aspackv2bootkitpersistence

Malware Config

Targets

    • Target

      193a2f1f586f5966a670c0cebdcd767a

    • Size

      510KB

    • MD5

      193a2f1f586f5966a670c0cebdcd767a

    • SHA1

      80747541e667065c5224e45858147b9491af5106

    • SHA256

      d5eb64a4299bc489d0e73aa95dd4bab67212169e1868137cba6654171f58f9fd

    • SHA512

      9e7f7e7b33fc5784be755874324344e45a05a85300c81f77ac881b9f526b436c847a8928e33d4ec2259d8c9e7254ac83fe24bd0405f37d4c3eaa3a2d6390f996

    • SSDEEP

      12288:qsMxi+i/NBzYLJpjJICcfkmOjuXCjhpehUNtTird:qsMxwNBkOf6jyIehETEd

    Score
    10/10
    bootkitpersistence

    • Modifies WinLogon for persistence

      persistence

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies WinLogon

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks