c712bf702c0aef50e80661a4031e307b9d6524c3f10ce3d83a80a83f7315b9de | Triage

Sharing

General

Target

c712bf702c0aef50e80661a4031e307b9d6524c3f10ce3d83a80a83f7315b9de
Size

2.3MB
Sample

241031-j7s84awlel
MD5

bbf57cb30bb9394c266b937611f72cf8
SHA1

6316d5dcea4aebc995d7114d73594f2b4c0de558
SHA256

c712bf702c0aef50e80661a4031e307b9d6524c3f10ce3d83a80a83f7315b9de
SHA512

a01a50f238bfe731fd33651c1552d02e8f82a3a58c1fb948ff9cffc43cb04ede1e2bd498d1c89034b42407dce1e8f4726bb5d9dafd4fbdb30262b53072fe57e2
SSDEEP

49152:P9J95d76suD+XFA+5aa5i50PYDwyt64fQyHbbf08xwmaQFur:P9LvesuDRna5JPYGy7bMpL

Score

7^/10

bootkit discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  c712bf702c0aef50e80661a4031e307b9d6524c3f10ce3d83a80a83f7315b9de
- Size
  
  2.3MB
- MD5
  
  bbf57cb30bb9394c266b937611f72cf8
- SHA1
  
  6316d5dcea4aebc995d7114d73594f2b4c0de558
- SHA256
  
  c712bf702c0aef50e80661a4031e307b9d6524c3f10ce3d83a80a83f7315b9de
- SHA512
  
  a01a50f238bfe731fd33651c1552d02e8f82a3a58c1fb948ff9cffc43cb04ede1e2bd498d1c89034b42407dce1e8f4726bb5d9dafd4fbdb30262b53072fe57e2
- SSDEEP
  
  49152:P9J95d76suD+XFA+5aa5i50PYDwyt64fQyHbbf08xwmaQFur:P9LvesuDRna5JPYGy7bMpL
Score

7^/10

bootkit discovery evasion persistence trojan
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoveryevasionpersistencetrojan

behavioral2

bootkitdiscoveryevasionpersistencetrojan