d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772 | Triage

Submit
Reports

Overview

overview

6

Static

static

1

d19fe85036...72.exe

windows7-x64

6

d19fe85036...72.exe

windows10-2004-x64

6

Sharing

General

Target

d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772.exe
Size

5.5MB
Sample

241101-tv3bca1lbx
MD5

8d76bb0011099f752d1df93ad3f697f2
SHA1

467d3da8b2fa7ff0d2958d30c3345c109647e09d
SHA256

d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772
SHA512

1526f49a0b14ed46c0fc68781e71009121e6f9807a3c262d6fa50c69fb37f59a711c9ae383ed8f30ed14b60456aafc80bfac10fccf90ef6fc27d4191693ddc8d
SSDEEP

98304:irI1lEAOYB6RJ2dqW8LZJc+ZQSAA4zJOi6f4s9w0dGzB/vr:RXGULEFrcPJzAxf4+FGVD

Score

6^/10

bootkit discovery evasion persistence privilege_escalation trojan

Static task

static1

Behavioral task

behavioral1

Sample

d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772.exe

Resource

win7-20241010-en

bootkit discovery evasion persistence privilege_escalation trojan

windows7-x64

23 signatures

150 seconds

Behavioral task

behavioral2

Sample

d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772.exe

Resource

win10v2004-20241007-en

bootkit discovery evasion persistence privilege_escalation trojan

windows10-2004-x64

22 signatures

150 seconds

Malware Config

Targets

- Target
  
  d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772.exe
- Size
  
  5.5MB
- MD5
  
  8d76bb0011099f752d1df93ad3f697f2
- SHA1
  
  467d3da8b2fa7ff0d2958d30c3345c109647e09d
- SHA256
  
  d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772
- SHA512
  
  1526f49a0b14ed46c0fc68781e71009121e6f9807a3c262d6fa50c69fb37f59a711c9ae383ed8f30ed14b60456aafc80bfac10fccf90ef6fc27d4191693ddc8d
- SSDEEP
  
  98304:irI1lEAOYB6RJ2dqW8LZJc+ZQSAA4zJOi6f4s9w0dGzB/vr:RXGULEFrcPJzAxf4+FGVD
Score

6^/10

bootkit discovery evasion persistence privilege_escalation trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Change Default File Association

Component Object Model Hijacking

Pre-OS Boot

Bootkit

Privilege Escalation

Event Triggered Execution

Change Default File Association

Component Object Model Hijacking

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

bootkitdiscoveryevasionpersistenceprivilege_escalationtrojan

© 2018-2024

Terms | Privacy