Overview

overview

10

Static

static

1

bitdefende...ee.exe

windows7-x64

10

bitdefende...ee.exe

windows10-1703-x64

6

bitdefende...ee.exe

windows10-2004-x64

6

bitdefende...ee.exe

windows11-21h2-x64

6

Resubmissions

08-08-2024 23:22

240808-3c2frswcmh 6

08-08-2024 18:12

240808-wte6jaxanr 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bitdefender_avfree.exe

  • Size

    14.1MB

  • Sample

    240808-wte6jaxanr

  • MD5

    fd1e2d74ee69d385ffe392de738a09a8

  • SHA1

    cffdc38420d50f6d2672fc5c9c3267f12b8d08b8

  • SHA256

    ba580f566eff785f741c99a84877b6e867b8805210c91205b5bcd21a59fa7aeb

  • SHA512

    94352897ab620e1970ab895bc5372ddf188ef2d2878965b2ff54efbfc61ff5a15019fa6f96bebc7142a997ce625c6d6e3685aa972fbff2c18627fc7fc0e55890

  • SSDEEP

    393216:eVyaXw17m887vq+vb7fmBWASpNuGNvHqmbeQ:yyaA17mfq+vb6WAooixf

Score
10/10
infinitylockbootkitdefense_evasiondiscoverypersistenceransomware

Malware Config

Targets

    • Target

      bitdefender_avfree.exe

    • Size

      14.1MB

    • MD5

      fd1e2d74ee69d385ffe392de738a09a8

    • SHA1

      cffdc38420d50f6d2672fc5c9c3267f12b8d08b8

    • SHA256

      ba580f566eff785f741c99a84877b6e867b8805210c91205b5bcd21a59fa7aeb

    • SHA512

      94352897ab620e1970ab895bc5372ddf188ef2d2878965b2ff54efbfc61ff5a15019fa6f96bebc7142a997ce625c6d6e3685aa972fbff2c18627fc7fc0e55890

    • SSDEEP

      393216:eVyaXw17m887vq+vb7fmBWASpNuGNvHqmbeQ:yyaA17mfq+vb6WAooixf

    Score
    10/10
    infinitylockbootkitdefense_evasiondiscoverypersistenceransomware

    • InfinityLock Ransomware

      Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

      ransomwareinfinitylock

    • Drops file in Drivers directory

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Downloads MZ/PE file

    • Legitimate hosting services abused for malware hosting/C2

    • Program crash

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

4
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

7
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks