Overview

overview

8

Static

static

3

overwriteb.exe

windows7-x64

8

overwriteb.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    overwriteb.exe

  • Size

    1.2MB

  • Sample

    240810-s7bhqawcrp

  • MD5

    48bcfadbe442385efaecbb345659f34b

  • SHA1

    457db1ed90ada965472d19c612118cbf6a265c7e

  • SHA256

    3e68a8d85a3429226ed2cb9f16b16e715bb53d3ee34d06cdaad05cbf49880ff9

  • SHA512

    4a36646a08101014d44e95fab64259fa49f3f41cc8bce16e13b0db2a72d13aea9cec7bdfcfbfc50b1d0aceddace4e7ecaefa40aaf95504a249d33f2cc34a3425

  • SSDEEP

    12288:0jcmBRMTqnYx6XZ7aUXYXVeCHkAVz5CntHsh9Z+DX87Kf+iXhhnCkAclRXhyxVUt:OBRMTqnYx6XZ7aU0VuMKf7nCkAMY

Score
8/10
bootkitdiscoveryexploitpersistence

Malware Config

Targets

    • Target

      overwriteb.exe

    • Size

      1.2MB

    • MD5

      48bcfadbe442385efaecbb345659f34b

    • SHA1

      457db1ed90ada965472d19c612118cbf6a265c7e

    • SHA256

      3e68a8d85a3429226ed2cb9f16b16e715bb53d3ee34d06cdaad05cbf49880ff9

    • SHA512

      4a36646a08101014d44e95fab64259fa49f3f41cc8bce16e13b0db2a72d13aea9cec7bdfcfbfc50b1d0aceddace4e7ecaefa40aaf95504a249d33f2cc34a3425

    • SSDEEP

      12288:0jcmBRMTqnYx6XZ7aUXYXVeCHkAVz5CntHsh9Z+DX87Kf+iXhhnCkAclRXhyxVUt:OBRMTqnYx6XZ7aU0VuMKf7nCkAMY

    Score
    8/10
    bootkitdiscoveryexploitpersistence

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks