dd4bd8a2097d961a5fab0f266f4f53c5131364bbea4c8e66e42bcae87b9de04d | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

GLP_instal...er.exe

windows10-1703-x64

9

Sharing

General

Target

GLP_installer_900223152_com.activision.callofduty.shooter.exe
Size

3.6MB
Sample

240310-s9an7sff38
MD5

14c596c34978661885ff79f0d5cf24d0
SHA1

5d52c3c5b4d07210fe68fed0b3ff6b24bf31c4ee
SHA256

dd4bd8a2097d961a5fab0f266f4f53c5131364bbea4c8e66e42bcae87b9de04d
SHA512

2fddd3b4cd7148d71bbd441a795849d44e947ab6727ca700f3dc29ce2c0dbb94834eb9a6fab2b00749f12c726cc5d2f2bb7ea5d8919cade0730549f3b0e0b035
SSDEEP

49152:A08OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJXe9emEPGKOPkQThMYR1nm7LBt:A08vdsGaQNgS1C6eznukqb

Score

9^/10

bootkit discovery evasion persistence ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

GLP_installer_900223152_com.activision.callofduty.shooter.exe

Resource

win10-20240221-en

bootkit discovery evasion persistence ransomware

windows10-1703-x64

22 signatures

150 seconds

Malware Config

Targets

- Target
  
  GLP_installer_900223152_com.activision.callofduty.shooter.exe
- Size
  
  3.6MB
- MD5
  
  14c596c34978661885ff79f0d5cf24d0
- SHA1
  
  5d52c3c5b4d07210fe68fed0b3ff6b24bf31c4ee
- SHA256
  
  dd4bd8a2097d961a5fab0f266f4f53c5131364bbea4c8e66e42bcae87b9de04d
- SHA512
  
  2fddd3b4cd7148d71bbd441a795849d44e947ab6727ca700f3dc29ce2c0dbb94834eb9a6fab2b00749f12c726cc5d2f2bb7ea5d8919cade0730549f3b0e0b035
- SSDEEP
  
  49152:A08OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJXe9emEPGKOPkQThMYR1nm7LBt:A08vdsGaQNgS1C6eznukqb
Score

9^/10

bootkit discovery evasion persistence ransomware
- Renames multiple (94) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Pre-OS Boot

Bootkit

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoveryevasionpersistenceransomware

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.