Overview

overview

7

Static

static

3

a3fc1bfe8c...8N.exe

windows7-x64

7

a3fc1bfe8c...8N.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8N

  • Size

    552KB

  • Sample

    241002-bnwk4stdre

  • MD5

    fec60d703c2dc1fd493fe16c7ff6fac0

  • SHA1

    e5264760100beedf52886e684f15b5f84423be7a

  • SHA256

    a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8

  • SHA512

    23a7172d2b0cd82a542e83aec3a7375e02bc7bec3d3648c06b5a030c375afb04c24fc5fd8bc34a07a814cdd3083ed83cad04092f4983501f3bf24408aecf6309

  • SSDEEP

    12288:Pw2VKYTnqYX09dTWbXv9BWtnFysQ9d87iBn1p+iG/8y4k:1KAnqYMdTWbXlenFQG+Bn1p+ftP

Score
7/10
bootkitdefense_evasiondiscoverypersistence

Malware Config

Targets

    • Target

      a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8N

    • Size

      552KB

    • MD5

      fec60d703c2dc1fd493fe16c7ff6fac0

    • SHA1

      e5264760100beedf52886e684f15b5f84423be7a

    • SHA256

      a3fc1bfe8ccd04a4e0add1ee7e470bbfc8c9f92af6c24b619703ce58074830c8

    • SHA512

      23a7172d2b0cd82a542e83aec3a7375e02bc7bec3d3648c06b5a030c375afb04c24fc5fd8bc34a07a814cdd3083ed83cad04092f4983501f3bf24408aecf6309

    • SSDEEP

      12288:Pw2VKYTnqYX09dTWbXv9BWtnFysQ9d87iBn1p+iG/8y4k:1KAnqYMdTWbXlenFQG+Bn1p+ftP

    Score
    7/10
    discoverybootkitdefense_evasionpersistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks