Overview

overview

8

Static

static

1

Bez tytułu.png

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bez tytułu.png

  • Size

    210B

  • Sample

    240425-pbzc5aae21

  • MD5

    96406703da080780229fa319f2448994

  • SHA1

    787b6fe4be3e95e0592f9deddaccdb2a5eb4ce41

  • SHA256

    9ae0449c3a39d09fd963fce70aae5bc6f5ff2f08bfa902d306b40f33bdaa3cef

  • SHA512

    c136373ed8c0683dc69e6b56c6bf7a2166b86621ac74de0bdca59bfaa0f1c65d7e3b451be3c981f37dcd130ce053d14137fe059d0a22b2834580ab6493b1e325

Score
8/10
bootkitdiscoverypersistenceransomware

Malware Config

Targets

    • Target

      Bez tytułu.png

    • Size

      210B

    • MD5

      96406703da080780229fa319f2448994

    • SHA1

      787b6fe4be3e95e0592f9deddaccdb2a5eb4ce41

    • SHA256

      9ae0449c3a39d09fd963fce70aae5bc6f5ff2f08bfa902d306b40f33bdaa3cef

    • SHA512

      c136373ed8c0683dc69e6b56c6bf7a2166b86621ac74de0bdca59bfaa0f1c65d7e3b451be3c981f37dcd130ce053d14137fe059d0a22b2834580ab6493b1e325

    Score
    8/10
    bootkitdiscoverypersistenceransomware

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Defense Evasion

Modify Registry

5
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks