Resubmissions
20/11/2024, 07:25
241120-h8x31ayjfm 820/11/2024, 07:21
241120-h66x5atlbw 810/11/2024, 05:39
241110-gcfcmszpcv 708/11/2024, 14:16
241108-rk66fateqm 903/11/2024, 22:20
241103-19b62avnhz 1003/11/2024, 19:28
241103-x6mltasbqf 702/11/2024, 18:12
241102-wtak2ssamm 702/11/2024, 16:37
241102-t45stszdrj 702/11/2024, 08:58
241102-kxfexssqem 1002/11/2024, 07:51
241102-jpyqvs1drm 3General
-
Target
Bootstrapper.exe
-
Size
800KB
-
Sample
241108-rk66fateqm
-
MD5
2a4dcf20b82896be94eb538260c5fb93
-
SHA1
21f232c2fd8132f8677e53258562ad98b455e679
-
SHA256
ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a
-
SHA512
4f1164b2312fb94b7030d6eb6aa9f3502912ffa33505f156443570fc964bfd3bb21ded3cf84092054e07346d2dce83a0907ba33f4ba39ad3fe7a78e836efe288
-
SSDEEP
12288:t0zVvgDNMoWjTmFzAzBocaKjyWtiR1pptHxQ0z:O5vgHWjTwAlocaKjyyItHDz
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
Bootstrapper.exe
-
Size
800KB
-
MD5
2a4dcf20b82896be94eb538260c5fb93
-
SHA1
21f232c2fd8132f8677e53258562ad98b455e679
-
SHA256
ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a
-
SHA512
4f1164b2312fb94b7030d6eb6aa9f3502912ffa33505f156443570fc964bfd3bb21ded3cf84092054e07346d2dce83a0907ba33f4ba39ad3fe7a78e836efe288
-
SSDEEP
12288:t0zVvgDNMoWjTmFzAzBocaKjyWtiR1pptHxQ0z:O5vgHWjTwAlocaKjyyItHDz
-
Modifies boot configuration data using bcdedit
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Creates new service(s)
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Sets service image path in registry
-
A potential corporate email address has been identified in the URL: [email protected]
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Deletes itself
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Blocklisted process makes network request
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Modifies WinLogon
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Modify Registry
7Pre-OS Boot
1Bootkit
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
7Software Discovery
1Security Software Discovery
1System Information Discovery
9System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1