ca854acb38a73997e862f7693d0e60adf75b22d7b6626ae66260713079fbd3f4 | Triage

Sharing

General

Target

Bootstrapper.exe
Size

5.9MB
Sample

240909-ytjvtszara
MD5

71f9acc8a05119570909a439ab55dad7
SHA1

c84a8f6554207ae3604e7d8ce7ae6890a67ed28b
SHA256

ca854acb38a73997e862f7693d0e60adf75b22d7b6626ae66260713079fbd3f4
SHA512

ac54ee23bdc79b850454290df452df046e95ebd59cb6510789b07a685ba8feba3c0b7c1b00e940aebe6a23f1baac329922636c459ac98026f184718a1244a4fc
SSDEEP

98304:Q2ZaNFr1TwxexfjKAQQVc6bW/g84zg7WJFKoX0pSBEXBZ44iuGasi7b76hoy:QXZe6i/gps7MtXUDXBZtiuoqPao

Score

8^/10

defense_evasion discovery evasion execution persistence

Malware Config

Targets

- Target
  
  Bootstrapper.exe
- Size
  
  5.9MB
- MD5
  
  71f9acc8a05119570909a439ab55dad7
- SHA1
  
  c84a8f6554207ae3604e7d8ce7ae6890a67ed28b
- SHA256
  
  ca854acb38a73997e862f7693d0e60adf75b22d7b6626ae66260713079fbd3f4
- SHA512
  
  ac54ee23bdc79b850454290df452df046e95ebd59cb6510789b07a685ba8feba3c0b7c1b00e940aebe6a23f1baac329922636c459ac98026f184718a1244a4fc
- SSDEEP
  
  98304:Q2ZaNFr1TwxexfjKAQQVc6bW/g84zg7WJFKoX0pSBEXBZ44iuGasi7b76hoy:QXZe6i/gps7MtXUDXBZtiuoqPao
Score

8^/10

defense_evasion discovery evasion execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Power Settings

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Obfuscated Files or Information

Command Obfuscation

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionpersistence