a821ce05843c06fc361ca31a8cd301d742cfe20a92b538abdc2f7b89853662e8 | Triage

Sharing

General

Target

a821ce05843c06fc361ca31a8cd301d742cfe20a92b538abdc2f7b89853662e8
Size

4.8MB
Sample

240911-ednpas1cmq
MD5

237173b3baca0dd89de8f08f87a73102
SHA1

eb0fbca2301e5b15538f97358c0c305076eb9171
SHA256

a821ce05843c06fc361ca31a8cd301d742cfe20a92b538abdc2f7b89853662e8
SHA512

06210abc17c4240a83b46c578b78c344931edc519f389783036f17acd79780d63f9bd14bfe2813423aac4b6ccdf61606fee163ebcc9867d5b059e479994c2959
SSDEEP

98304:cVeM4VwHuokyfK8PGcx2HynIiprw0F80XZeG5:6AVw6kx2SnIe84eG5

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  a821ce05843c06fc361ca31a8cd301d742cfe20a92b538abdc2f7b89853662e8
- Size
  
  4.8MB
- MD5
  
  237173b3baca0dd89de8f08f87a73102
- SHA1
  
  eb0fbca2301e5b15538f97358c0c305076eb9171
- SHA256
  
  a821ce05843c06fc361ca31a8cd301d742cfe20a92b538abdc2f7b89853662e8
- SHA512
  
  06210abc17c4240a83b46c578b78c344931edc519f389783036f17acd79780d63f9bd14bfe2813423aac4b6ccdf61606fee163ebcc9867d5b059e479994c2959
- SSDEEP
  
  98304:cVeM4VwHuokyfK8PGcx2HynIiprw0F80XZeG5:6AVw6kx2SnIe84eG5
Score

7^/10

bootkit discovery persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

bootkitdiscoverypersistence