4e349002401cf0bbb35036a3b73dd51935ebb617cb677162c655bab9e1def1b9 | Triage

Sharing

General

Target

63d781dd973d3f343fd0ee7ad13a7325
Size

155KB
Sample

240117-22d64agagl
MD5

63d781dd973d3f343fd0ee7ad13a7325
SHA1

4e1362a66a1de15d23fcc5dc49f685c31da915fe
SHA256

4e349002401cf0bbb35036a3b73dd51935ebb617cb677162c655bab9e1def1b9
SHA512

720ad274b096eb4077ff03d2225b3f06555966cd371959475d3819236f775c9f6cfbf48edb62de35c2939dcdab999e7a43555751bbb20637eca0e556a0c3befe
SSDEEP

3072:xE6/ZAai+j6RmtzBSfQCYbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7f:JDj6ezBCQRwvP6bQ7yMP+DE827f

Score

7^/10

bootkit persistence

Malware Config

Targets

- Target
  
  63d781dd973d3f343fd0ee7ad13a7325
- Size
  
  155KB
- MD5
  
  63d781dd973d3f343fd0ee7ad13a7325
- SHA1
  
  4e1362a66a1de15d23fcc5dc49f685c31da915fe
- SHA256
  
  4e349002401cf0bbb35036a3b73dd51935ebb617cb677162c655bab9e1def1b9
- SHA512
  
  720ad274b096eb4077ff03d2225b3f06555966cd371959475d3819236f775c9f6cfbf48edb62de35c2939dcdab999e7a43555751bbb20637eca0e556a0c3befe
- SSDEEP
  
  3072:xE6/ZAai+j6RmtzBSfQCYbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7f:JDj6ezBCQRwvP6bQ7yMP+DE827f
Score

7^/10

bootkit persistence
- Deletes itself
- Modifies WinLogon
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitpersistence

behavioral2