f58b07195184337a73c5936fbdd0467800657d4b8890c4329e7291bd2834792d | Triage

Sharing

General

Target

startup.exe
Size

4.3MB
Sample

240725-vc2grswapd
MD5

5aad72df3124c0114273a68064b10835
SHA1

a29b8a22b34b417b8a63a6321535b535708ec66b
SHA256

f58b07195184337a73c5936fbdd0467800657d4b8890c4329e7291bd2834792d
SHA512

5da9d1cef6ff4f8514118c92fd36e321fab3b527a24651ff8481cb7da01f7fbd3cff1a4afde5ab395dd8933f9a32eb088f73a56e81b8f63880f3f5fda15d2c3a
SSDEEP

98304:Apq/d8kCBWlMyQjujDW9tBcg2jGqwwArl6zwRGaTfdQ5ekB3tiXn6:hcV5ujyp8jGqww2l6wRGaTfmfNtmn6

Score

7^/10

bootkit discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  startup.exe
- Size
  
  4.3MB
- MD5
  
  5aad72df3124c0114273a68064b10835
- SHA1
  
  a29b8a22b34b417b8a63a6321535b535708ec66b
- SHA256
  
  f58b07195184337a73c5936fbdd0467800657d4b8890c4329e7291bd2834792d
- SHA512
  
  5da9d1cef6ff4f8514118c92fd36e321fab3b527a24651ff8481cb7da01f7fbd3cff1a4afde5ab395dd8933f9a32eb088f73a56e81b8f63880f3f5fda15d2c3a
- SSDEEP
  
  98304:Apq/d8kCBWlMyQjujDW9tBcg2jGqwwArl6zwRGaTfdQ5ekB3tiXn6:hcV5ujyp8jGqww2l6wRGaTfmfNtmn6
Score

7^/10

bootkit discovery evasion persistence trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoveryevasionpersistencetrojan