General

  • Target

    Boostrapper.zip

  • Size

    12.0MB

  • Sample

    241111-xty43stjdt

  • MD5

    188299a153606381b5e3afd5e8154bef

  • SHA1

    14318e531d88e22fe52aba82f35e5cfabd0d6504

  • SHA256

    1afe29908f06e5ac5411156b4e7bd4f795a78551c404008043026fe77678dcd6

  • SHA512

    0bb2f0524c5155f2370ef8fb8d0283716a33a739c9c91fff3eeab818c6821355f45058603b4ac6ed2c634f7cf3248cf466c09b35c6598e34121b2983ceeca84e

  • SSDEEP

    196608:Jjcm2K81udYdiCGexHVGgnyKoVwIqo1ALC5sn/DIV2b/9q4qfZssaDVKDB2qT+9A:JjcY81JiCGexHVG4IxEn/DIgbFq4qBTz

Malware Config

Targets

    • Target

      Boostrapper.exe

    • Size

      31.5MB

    • MD5

      175b9e391637edd017297b5a55260e11

    • SHA1

      deefdf349c0387d4122cac4c2be5d3f7c67b2711

    • SHA256

      596fe7b378dcaf8c772f4ddb3295aaab9db0496bd8115753d5c76cecfa937510

    • SHA512

      81e37bf87556ffa0806f62ab6376c097b62c0b3d7776dc3fb276768c72db8e2d21e7674ac02e00d9aefbf8b1313e1851973af37cd4bed27a9c234c555326c6b3

    • SSDEEP

      393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgu96l+ZArYsFRlH:R3on1HvSzxAMNuFZArYs/

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Enumerates processes with tasklist

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks