Overview

overview

7

Static

static

1

file01.ps1

windows7-x64

3

file01.ps1

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file01.ps1

  • Size

    33KB

  • Sample

    240524-1jw4hsca8x

  • MD5

    e642c5873cacc23d7f6e6b90ab27d2da

  • SHA1

    bfa20491ff128faeb8955eef9fcb711c0d54b0c4

  • SHA256

    e64e7f9a8ac57ab663e80db5f529150e85cdfb2e31e40b6a7d11597504841733

  • SHA512

    5acb8e36422bb9df085001f59633110bccf037bff5b69a27c44a1becf3f62410c39d04756bc0d697f6f6b1190c4ee358c54b059ee7f1c204db18db21309a2242

  • SSDEEP

    384:OzPfXPbxFqTy/rThUYp/L4Gh/im/GtJ2Klb6o+5VxIBAftppOKyyPfvkU67GypZC:qfbxIT1fhaVp8CeHad

Score
7/10
bootkitexecutionpersistence

Malware Config

Targets

    • Target

      file01.ps1

    • Size

      33KB

    • MD5

      e642c5873cacc23d7f6e6b90ab27d2da

    • SHA1

      bfa20491ff128faeb8955eef9fcb711c0d54b0c4

    • SHA256

      e64e7f9a8ac57ab663e80db5f529150e85cdfb2e31e40b6a7d11597504841733

    • SHA512

      5acb8e36422bb9df085001f59633110bccf037bff5b69a27c44a1becf3f62410c39d04756bc0d697f6f6b1190c4ee358c54b059ee7f1c204db18db21309a2242

    • SSDEEP

      384:OzPfXPbxFqTy/rThUYp/L4Gh/im/GtJ2Klb6o+5VxIBAftppOKyyPfvkU67GypZC:qfbxIT1fhaVp8CeHad

    Score
    7/10
    executionbootkitpersistence

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

JavaScript

1
T1059.007

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks