Overview

overview

8

Static

static

1

URLScan

urlscan

https://www.google.c...

windows10-2004-x64

8

Resubmissions

17-04-2024 14:27

240417-rsxa7sdd6x 10

17-04-2024 14:17

240417-rl6lasbe47 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://www.google.com/search?q=how+to+download+a+windows+10+iso&rlz=1C1GCEA_enUS1102US1102&oq=how+to+download+a+windows+&gs_lcrp=EgZjaHJvbWUqBwgBEAAYgAQyBwgAEAAYgAQyBwgBEAAYgAQyBwgCEAAYgAQyBggDEEUYOTIHCAQQABiABDIHCAUQABiABDIHCAYQABiABDIHCAcQABiABDIHCAgQABiABDIHCAkQABiABNIBCDc4NjZqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8&safe=active&ssui=on

  • Sample

    240417-rl6lasbe47

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      https://www.google.com/search?q=how+to+download+a+windows+10+iso&rlz=1C1GCEA_enUS1102US1102&oq=how+to+download+a+windows+&gs_lcrp=EgZjaHJvbWUqBwgBEAAYgAQyBwgAEAAYgAQyBwgBEAAYgAQyBwgCEAAYgAQyBggDEEUYOTIHCAQQABiABDIHCAUQABiABDIHCAYQABiABDIHCAcQABiABDIHCAgQABiABDIHCAkQABiABNIBCDc4NjZqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8&safe=active&ssui=on

    Score
    8/10
    bootkitpersistence

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks