Overview

overview

9

Static

static

3

6f02f16bf4...b7.exe

windows7-x64

9

6f02f16bf4...b7.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7.exe

  • Size

    512KB

  • Sample

    240523-b2dmfshb45

  • MD5

    164b5f30f5f77b6e74b2197869bd4cc6

  • SHA1

    93126f1f312c3a48fb5fdad0f2ad757c77f7b94c

  • SHA256

    6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7

  • SHA512

    86da2c61879533032ed09bbc4533f01af215e30da7aae250cd510e95c80d9d60a817b249b630822ff385e85a337f6a70176f157b70a27226b9c9c5e9e8ce5c35

  • SSDEEP

    12288:GR41sKv76QD7ETeGAJE9OTn9bkLOy6zh9B3t1:GR4jeHTeGy2OT94izh

Score
9/10
bootkitpersistence

Malware Config

Targets

    • Target

      6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7.exe

    • Size

      512KB

    • MD5

      164b5f30f5f77b6e74b2197869bd4cc6

    • SHA1

      93126f1f312c3a48fb5fdad0f2ad757c77f7b94c

    • SHA256

      6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7

    • SHA512

      86da2c61879533032ed09bbc4533f01af215e30da7aae250cd510e95c80d9d60a817b249b630822ff385e85a337f6a70176f157b70a27226b9c9c5e9e8ce5c35

    • SSDEEP

      12288:GR41sKv76QD7ETeGAJE9OTn9bkLOy6zh9B3t1:GR4jeHTeGy2OT94izh

    Score
    9/10
    bootkitpersistence

    • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks