Overview

overview

8

Static

static

1

MacDrive 1...up.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    MacDrive 11.1.0.26 Setup.exe

  • Size

    10.6MB

  • Sample

    240505-n6d51ahd4y

  • MD5

    12f146396ca3c7f65c479e9f8f80cef3

  • SHA1

    74c0b84efacb9ffa0341fa9aea7cf1f232710413

  • SHA256

    d54cd7a1079555d90a0c80d2a9510cba0357290b9e29b585080411040eef0e3f

  • SHA512

    588247516b132876d3d52b2f9d59273da0e4b10598d89d0d4fdfc1e68cc9094149d2649f484db8ca9a250e3bd2f0b402851359b363284c8b7f089d9eb249e689

  • SSDEEP

    196608:dle10tPVJ2oSle5QA5coSd7Tzg3535We0yc62CcTpx6d1S06XsvbarmLFpPn/w:dl00RGlAuAuX9XCcTpx6d1S0HjuypP/w

Score
8/10
bootkitdiscoverypersistence

Malware Config

Targets

    • Target

      MacDrive 11.1.0.26 Setup.exe

    • Size

      10.6MB

    • MD5

      12f146396ca3c7f65c479e9f8f80cef3

    • SHA1

      74c0b84efacb9ffa0341fa9aea7cf1f232710413

    • SHA256

      d54cd7a1079555d90a0c80d2a9510cba0357290b9e29b585080411040eef0e3f

    • SHA512

      588247516b132876d3d52b2f9d59273da0e4b10598d89d0d4fdfc1e68cc9094149d2649f484db8ca9a250e3bd2f0b402851359b363284c8b7f089d9eb249e689

    • SSDEEP

      196608:dle10tPVJ2oSle5QA5coSd7Tzg3535We0yc62CcTpx6d1S06XsvbarmLFpPn/w:dl00RGlAuAuX9XCcTpx6d1S0HjuypP/w

    Score
    8/10
    bootkitdiscoverypersistence

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks