e957d9e103a9e0c3b52d285e66cc17fc7b6b6b1b15a2662081e7320c47555aab | Triage

Sharing

General

Target

e957d9e103a9e0c3b52d285e66cc17fc7b6b6b1b15a2662081e7320c47555aab
Size

3.8MB
Sample

240826-ahj5fstcnb
MD5

243fb2d941347bb9da31a7db9e6c9c5f
SHA1

ecb18811a3289981c310e7a3acfde37149361eaf
SHA256

e957d9e103a9e0c3b52d285e66cc17fc7b6b6b1b15a2662081e7320c47555aab
SHA512

c7b42c52ef17257a6715f73d761211e04ca28d52d08a6fbe8003f43733244d5891648947a0a4cc10982f01a8943c4905e1f3a2263543ce083c6c855dacc5fe41
SSDEEP

49152:0sNwoFRoyw9Yxq8A5CVzPIygMuSGOp09B/pwJrN6GFVfoPpNf9CXmYnMBR/Gl1:bNwoFWyFGCTgBVPG5o28N1bYnMBK

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  e957d9e103a9e0c3b52d285e66cc17fc7b6b6b1b15a2662081e7320c47555aab
- Size
  
  3.8MB
- MD5
  
  243fb2d941347bb9da31a7db9e6c9c5f
- SHA1
  
  ecb18811a3289981c310e7a3acfde37149361eaf
- SHA256
  
  e957d9e103a9e0c3b52d285e66cc17fc7b6b6b1b15a2662081e7320c47555aab
- SHA512
  
  c7b42c52ef17257a6715f73d761211e04ca28d52d08a6fbe8003f43733244d5891648947a0a4cc10982f01a8943c4905e1f3a2263543ce083c6c855dacc5fe41
- SSDEEP
  
  49152:0sNwoFRoyw9Yxq8A5CVzPIygMuSGOp09B/pwJrN6GFVfoPpNf9CXmYnMBR/Gl1:bNwoFWyFGCTgBVPG5o28N1bYnMBK
Score

7^/10

bootkit discovery persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

bootkitdiscoverypersistence