Overview

overview

6

Static

static

3

7c4d5f22c1...96.exe

windows7-x64

6

7c4d5f22c1...96.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c4d5f22c14ddd1663affd59b46d9a62c481128269bf47022e55fc8290fe7296

  • Size

    2.0MB

  • Sample

    240526-hcqn2saa71

  • MD5

    eb6ea135b25d2a6b347c1dab328b89bd

  • SHA1

    20abdbd223f895544f64c8027075de5bcb99cf49

  • SHA256

    7c4d5f22c14ddd1663affd59b46d9a62c481128269bf47022e55fc8290fe7296

  • SHA512

    ba43f17a0deaa18b0569a4c4d4bd75544d797aa2766454bab44c96ff6e1987f82b64e8fbcc0d2c76f7bdb102208c2d04a712d6ff91c6661ff957efbabf492454

  • SSDEEP

    24576:Ox7tu7Mqi2JoSGW6AzKw6BfSjkekL5uYivdO5yDZaqsR+2QL4RFBgYe25Gj6qrvx:4XBS3YAOSshdRFBti6q6o9

Score
6/10
bootkitpersistence

Malware Config

Targets

    • Target

      7c4d5f22c14ddd1663affd59b46d9a62c481128269bf47022e55fc8290fe7296

    • Size

      2.0MB

    • MD5

      eb6ea135b25d2a6b347c1dab328b89bd

    • SHA1

      20abdbd223f895544f64c8027075de5bcb99cf49

    • SHA256

      7c4d5f22c14ddd1663affd59b46d9a62c481128269bf47022e55fc8290fe7296

    • SHA512

      ba43f17a0deaa18b0569a4c4d4bd75544d797aa2766454bab44c96ff6e1987f82b64e8fbcc0d2c76f7bdb102208c2d04a712d6ff91c6661ff957efbabf492454

    • SSDEEP

      24576:Ox7tu7Mqi2JoSGW6AzKw6BfSjkekL5uYivdO5yDZaqsR+2QL4RFBgYe25Gj6qrvx:4XBS3YAOSshdRFBti6q6o9

    Score
    6/10
    bootkitpersistence

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks