General
-
Target
a791a372f7f057a9558b397c13e3b6e11378558100fa8a293d130a4f6fe1e91f
-
Size
406KB
-
Sample
240523-wxv16abe98
-
MD5
17cf26672b690c7662653f6de207de19
-
SHA1
1adcb9a9edc4b4694cccce9cea388ec335bb013c
-
SHA256
a791a372f7f057a9558b397c13e3b6e11378558100fa8a293d130a4f6fe1e91f
-
SHA512
86a65d4c19bb9c070fcd43145668123649569042cbf93b993565ff2994531550c975d5b741a1c35ab2c203a0a8efc83a9652cebd67c0f973319e269d0db28e30
-
SSDEEP
6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH45:gtRfJcNYFNm8UhlZGse5
Static task
static1
Behavioral task
behavioral1
Sample
a791a372f7f057a9558b397c13e3b6e11378558100fa8a293d130a4f6fe1e91f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a791a372f7f057a9558b397c13e3b6e11378558100fa8a293d130a4f6fe1e91f.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
a791a372f7f057a9558b397c13e3b6e11378558100fa8a293d130a4f6fe1e91f
-
Size
406KB
-
MD5
17cf26672b690c7662653f6de207de19
-
SHA1
1adcb9a9edc4b4694cccce9cea388ec335bb013c
-
SHA256
a791a372f7f057a9558b397c13e3b6e11378558100fa8a293d130a4f6fe1e91f
-
SHA512
86a65d4c19bb9c070fcd43145668123649569042cbf93b993565ff2994531550c975d5b741a1c35ab2c203a0a8efc83a9652cebd67c0f973319e269d0db28e30
-
SSDEEP
6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH45:gtRfJcNYFNm8UhlZGse5
Score8/10-
Blocklisted process makes network request
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1