Overview

overview

9

Static

static

1

.html

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    .

  • Size

    153KB

  • Sample

    240524-szc2ksba67

  • MD5

    a6c90e8009dbb677531398bbe23c75eb

  • SHA1

    af7af53bfc0f4db150857a07fbe237f81b4fd116

  • SHA256

    435d2610aebbdfac613d8cf22749616ac411ad9717aabf91a9291120371add56

  • SHA512

    74914234cb9e96434563714460f98e4a43db200e9aafcd1cfa36914639daf79ce606a951d66f06c373af71d5a4684588732b53e38688f89b4a952f3ab3f54dff

  • SSDEEP

    1536:o7k8bHxYftVkMn1/R4Dillk0zSP30vD9328s4DiHhqiS:8k8ifPnRpllBwIoHhqiS

Score
9/10
bootkitdiscoveryevasionpersistenceransomware

Malware Config

Targets

    • Target

      .

    • Size

      153KB

    • MD5

      a6c90e8009dbb677531398bbe23c75eb

    • SHA1

      af7af53bfc0f4db150857a07fbe237f81b4fd116

    • SHA256

      435d2610aebbdfac613d8cf22749616ac411ad9717aabf91a9291120371add56

    • SHA512

      74914234cb9e96434563714460f98e4a43db200e9aafcd1cfa36914639daf79ce606a951d66f06c373af71d5a4684588732b53e38688f89b4a952f3ab3f54dff

    • SSDEEP

      1536:o7k8bHxYftVkMn1/R4Dillk0zSP30vD9328s4DiHhqiS:8k8ifPnRpllBwIoHhqiS

    Score
    9/10
    bootkitdiscoveryevasionpersistenceransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Resource Development

Reconnaissance

Tasks