Overview

overview

10

Static

static

10

Bootstrapper (2).exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bootstrapper (2).exe

  • Size

    7.5MB

  • Sample

    241027-wn7nlaxrgx

  • MD5

    1b6609f47c77316c46e2532eeeeb9c50

  • SHA1

    59ef132bc75e8c07195f368b2d27c07be6648a3f

  • SHA256

    de95cd9c02d66a6ef1062a96d598c2a31b0829653bf9d4db661dc695da680847

  • SHA512

    d6fc9e2aea1f237f771a0d4d6a646d471fb0bd234a837963cf84bab70ff2c511eb412f8883626826d47b9aefed1fba6bb77a758591b2fdc43344c6e425835e47

  • SSDEEP

    196608:r1gFFKwfI9jUC2gYBYv3vbW5+iITm1U6fj:CFFZIH2gYBgDW4TOzL

Score
10/10
blankgrabberevasionexecutionupx

Malware Config

Targets

    • Target

      Bootstrapper (2).exe

    • Size

      7.5MB

    • MD5

      1b6609f47c77316c46e2532eeeeb9c50

    • SHA1

      59ef132bc75e8c07195f368b2d27c07be6648a3f

    • SHA256

      de95cd9c02d66a6ef1062a96d598c2a31b0829653bf9d4db661dc695da680847

    • SHA512

      d6fc9e2aea1f237f771a0d4d6a646d471fb0bd234a837963cf84bab70ff2c511eb412f8883626826d47b9aefed1fba6bb77a758591b2fdc43344c6e425835e47

    • SSDEEP

      196608:r1gFFKwfI9jUC2gYBYv3vbW5+iITm1U6fj:CFFZIH2gYBgDW4TOzL

    Score
    10/10
    evasionexecutionupx

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks