Overview

overview

6

Static

static

1

Setup.exe

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target

    Setup.exe

  • Size

    65.0MB

  • Sample

    240614-t26mcasckj

  • MD5

    1d34d709183910e4cab6a65a3253ca57

  • SHA1

    1bf767ee4abd2a10f6f087102d5fd22f91b57368

  • SHA256

    3232039e042d0dc685370da3245f2ee7062f52237ef3c894302aa9cf88022736

  • SHA512

    3d99f18712258ecb5c4238d77d72bbfda54f499da0c57b7d11cec419e5dbf883db68f4a265f6e53efe1db2b3a2599a4b7ada83aedc9aeccc4ecd3154d11ab5cf

  • SSDEEP

    1572864:zQ5KCC4x4WyOVV74CtBbOAhx+9yqJGWpY7R/vvslpq7eFPne34yjGv/Q:zJqyOVKUOAhx+IGTpY7RvIpq7eteoyjP

Score
6/10
bootkitdiscoveryevasionpersistence

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      65.0MB

    • MD5

      1d34d709183910e4cab6a65a3253ca57

    • SHA1

      1bf767ee4abd2a10f6f087102d5fd22f91b57368

    • SHA256

      3232039e042d0dc685370da3245f2ee7062f52237ef3c894302aa9cf88022736

    • SHA512

      3d99f18712258ecb5c4238d77d72bbfda54f499da0c57b7d11cec419e5dbf883db68f4a265f6e53efe1db2b3a2599a4b7ada83aedc9aeccc4ecd3154d11ab5cf

    • SSDEEP

      1572864:zQ5KCC4x4WyOVV74CtBbOAhx+9yqJGWpY7R/vvslpq7eFPne34yjGv/Q:zJqyOVKUOAhx+IGTpY7RvIpq7eteoyjP

    Score
    6/10
    bootkitdiscoveryevasionpersistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Modifies Windows Firewall

      evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks