Overview

overview

10

Static

static

3

Bootstrapper.exe

windows7-x64

10

Bootstrapper.exe

windows10-1703-x64

10

Bootstrapper.exe

windows10-2004-x64

10

Bootstrapper.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Bootstrapper.exe

  • Size

    104KB

  • Sample

    240902-rm4hbsscjm

  • MD5

    7776882352548456cfc6f9827572d724

  • SHA1

    22785b7dac19933527255ef7a96fb331f7a455a5

  • SHA256

    6a850e209de722ad4f57dd68f8af405d62ad6557772717bbd86052d1fe43910f

  • SHA512

    9d0cdc083f75bf524484c231a69e5179bdcc6a6b4ab845ede88aa9ef0f336b0d3d67e90752c545272958f82d8f4fdd1293bd070bd56a3cadaa252d2b53e864e2

  • SSDEEP

    3072:CugCCyYwC+M2FE6CyYwC+M2FEa80IZOAr:CtChY7X2K6hY7X2Kah

Score
10/10
discoveryexecution

Malware Config

Targets

    • Target

      Bootstrapper.exe

    • Size

      104KB

    • MD5

      7776882352548456cfc6f9827572d724

    • SHA1

      22785b7dac19933527255ef7a96fb331f7a455a5

    • SHA256

      6a850e209de722ad4f57dd68f8af405d62ad6557772717bbd86052d1fe43910f

    • SHA512

      9d0cdc083f75bf524484c231a69e5179bdcc6a6b4ab845ede88aa9ef0f336b0d3d67e90752c545272958f82d8f4fdd1293bd070bd56a3cadaa252d2b53e864e2

    • SSDEEP

      3072:CugCCyYwC+M2FE6CyYwC+M2FEa80IZOAr:CtChY7X2K6hY7X2Kah

    Score
    10/10
    discoveryexecution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in System32 directory

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks