b41d20424f09c0e56789bb0758580094410ec379c675fb854ae16e2193505d8e | Triage

Sharing

General

Target

b41d20424f09c0e56789bb0758580094410ec379c675fb854ae16e2193505d8e
Size

4.8MB
Sample

240829-snpk8szgkj
MD5

9d1fc1f9ed629277d2e86e1d976dec81
SHA1

a66041233cc6c004978cf63b06c5d70d2b751f35
SHA256

b41d20424f09c0e56789bb0758580094410ec379c675fb854ae16e2193505d8e
SHA512

23ef5e569b2699ec83a73e2bb93e3a3ea2edb74bdd1854b529cbf0688b1fe3fcb409fb9d5d7cd6cfcd6cfa602cb6856e3e712821b973ce78dc5a767b270f668a
SSDEEP

98304:cVeM4VwHuokyfK8PGcx2HynIiprw0F80XZeG4:6AVw6kx2SnIe84eG4

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  b41d20424f09c0e56789bb0758580094410ec379c675fb854ae16e2193505d8e
- Size
  
  4.8MB
- MD5
  
  9d1fc1f9ed629277d2e86e1d976dec81
- SHA1
  
  a66041233cc6c004978cf63b06c5d70d2b751f35
- SHA256
  
  b41d20424f09c0e56789bb0758580094410ec379c675fb854ae16e2193505d8e
- SHA512
  
  23ef5e569b2699ec83a73e2bb93e3a3ea2edb74bdd1854b529cbf0688b1fe3fcb409fb9d5d7cd6cfcd6cfa602cb6856e3e712821b973ce78dc5a767b270f668a
- SSDEEP
  
  98304:cVeM4VwHuokyfK8PGcx2HynIiprw0F80XZeG4:6AVw6kx2SnIe84eG4
Score

7^/10

bootkit discovery persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

bootkitdiscoverypersistence