Overview

overview

9

Static

static

3

zzztest455.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    zzztest455.exe

  • Size

    8.1MB

  • Sample

    240726-3rc2qasdpj

  • MD5

    771d3bf4dd08aee1aeb4d16edda8ee0e

  • SHA1

    e90185fb391e06763b2d2efc4434be87cbd8f1ce

  • SHA256

    4e354e4e7b09eec60745e0e5a1f169da0d6dcc85b8df368c78c097fc54c61e5a

  • SHA512

    82ffaaee290ce6cf7c90552ce4fd7684b67a6a36c67ae028eeaae8a9e3d35a2b069ad43074feb9c7f69219ab4ea359bf53c24552fccb1dfc521dc74ee3be0e90

  • SSDEEP

    196608:b4KACcuywuLlA1HeT39Iigp1ncKOVVt0CTa7weBtQcNP+Z:EscuRr1+TtIiW0VuwA6f

Score
9/10
bootkitcredential_accessdiscoverypersistenceprivilege_escalationpyinstallerspywarestealer

Malware Config

Targets

    • Target

      zzztest455.exe

    • Size

      8.1MB

    • MD5

      771d3bf4dd08aee1aeb4d16edda8ee0e

    • SHA1

      e90185fb391e06763b2d2efc4434be87cbd8f1ce

    • SHA256

      4e354e4e7b09eec60745e0e5a1f169da0d6dcc85b8df368c78c097fc54c61e5a

    • SHA512

      82ffaaee290ce6cf7c90552ce4fd7684b67a6a36c67ae028eeaae8a9e3d35a2b069ad43074feb9c7f69219ab4ea359bf53c24552fccb1dfc521dc74ee3be0e90

    • SSDEEP

      196608:b4KACcuywuLlA1HeT39Iigp1ncKOVVt0CTa7weBtQcNP+Z:EscuRr1+TtIiW0VuwA6f

    Score
    9/10
    bootkitcredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks