Overview

overview

6

Static

static

1

PixelSee_i...id.exe

windows7-x64

6

PixelSee_i...id.exe

windows10-2004-x64

3

Resubmissions

22-04-2024 16:18

240422-tr6jlade4x 6

22-04-2024 16:15

240422-tqh2xadd9x 6

22-04-2024 16:08

240422-tlnftsdc28 6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PixelSee_id94944id.exe

  • Size

    4.8MB

  • Sample

    240422-tr6jlade4x

  • MD5

    39490d6ae5b10a8cdffecd71d05141dd

  • SHA1

    450da6260c6817aca8d9444831a48439ba45785c

  • SHA256

    a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb

  • SHA512

    7ffb9cb6a53cf233b6ff396eeb6193e683aed75001b3f73a1bbadaeec3ff7dcbce9b7e215d1743a4374e488185b824b90dde4afe93a8d93608b6340af07c14fb

  • SSDEEP

    98304:rcAf/HlqfEBwysMKalG8zzgg+t2TIJIX3gGKV0wMa8/FJjVBl5+pEs:rr/lqfEBwlMllPzzp+t2540w0jjVP5A

Score
6/10
bootkitdiscoveryevasionpersistence

Malware Config

Targets

    • Target

      PixelSee_id94944id.exe

    • Size

      4.8MB

    • MD5

      39490d6ae5b10a8cdffecd71d05141dd

    • SHA1

      450da6260c6817aca8d9444831a48439ba45785c

    • SHA256

      a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb

    • SHA512

      7ffb9cb6a53cf233b6ff396eeb6193e683aed75001b3f73a1bbadaeec3ff7dcbce9b7e215d1743a4374e488185b824b90dde4afe93a8d93608b6340af07c14fb

    • SSDEEP

      98304:rcAf/HlqfEBwysMKalG8zzgg+t2TIJIX3gGKV0wMa8/FJjVBl5+pEs:rr/lqfEBwlMllPzzp+t2540w0jjVP5A

    Score
    6/10
    bootkitdiscoveryevasionpersistence

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

3
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

2
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

2
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks