Overview

overview

8

Static

static

3

Scribble.exe

windows7-x64

8

Scribble.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    Scribble.exe

  • Size

    151KB

  • Sample

    240818-rq2sxaxekf

  • MD5

    27e436450784fbe473baf303881dcdf5

  • SHA1

    fa5eeae377f561584c2f3506398a5571f361e9df

  • SHA256

    c9e75720e352c6e706e34ba42383077de2551f88bd5ed5be6a6ecee49d037630

  • SHA512

    3dfbd46322f995e23d97a3d601b1ac01a554b67263d9dbd708dda327bbeedd49200c8bfc116cd3bc5b8b8f675794dbc81e5ea3813c155a1cead31a0065acce68

  • SSDEEP

    3072:9CwbScy+d/eUnmx9jOFc228XENhKeDmrvUgSVQ/jAv+yFu5nT0h7/Y:swbPnnmxJOFc228UNhKeDmrvUgSVQ/j6

Score
8/10
bootkitdiscoveryevasionpersistence

Malware Config

Targets

    • Target

      Scribble.exe

    • Size

      151KB

    • MD5

      27e436450784fbe473baf303881dcdf5

    • SHA1

      fa5eeae377f561584c2f3506398a5571f361e9df

    • SHA256

      c9e75720e352c6e706e34ba42383077de2551f88bd5ed5be6a6ecee49d037630

    • SHA512

      3dfbd46322f995e23d97a3d601b1ac01a554b67263d9dbd708dda327bbeedd49200c8bfc116cd3bc5b8b8f675794dbc81e5ea3813c155a1cead31a0065acce68

    • SSDEEP

      3072:9CwbScy+d/eUnmx9jOFc228XENhKeDmrvUgSVQ/jAv+yFu5nT0h7/Y:swbPnnmxJOFc228UNhKeDmrvUgSVQ/j6

    Score
    8/10
    bootkitevasionpersistencediscovery

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Drops desktop.ini file(s)

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks