General
-
Target
Boostrapper.zip
-
Size
12.0MB
-
Sample
241111-xty43stjdt
-
MD5
188299a153606381b5e3afd5e8154bef
-
SHA1
14318e531d88e22fe52aba82f35e5cfabd0d6504
-
SHA256
1afe29908f06e5ac5411156b4e7bd4f795a78551c404008043026fe77678dcd6
-
SHA512
0bb2f0524c5155f2370ef8fb8d0283716a33a739c9c91fff3eeab818c6821355f45058603b4ac6ed2c634f7cf3248cf466c09b35c6598e34121b2983ceeca84e
-
SSDEEP
196608:Jjcm2K81udYdiCGexHVGgnyKoVwIqo1ALC5sn/DIV2b/9q4qfZssaDVKDB2qT+9A:JjcY81JiCGexHVG4IxEn/DIgbFq4qBTz
Static task
static1
Behavioral task
behavioral1
Sample
Boostrapper.exe
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
Boostrapper.exe
-
Size
31.5MB
-
MD5
175b9e391637edd017297b5a55260e11
-
SHA1
deefdf349c0387d4122cac4c2be5d3f7c67b2711
-
SHA256
596fe7b378dcaf8c772f4ddb3295aaab9db0496bd8115753d5c76cecfa937510
-
SHA512
81e37bf87556ffa0806f62ab6376c097b62c0b3d7776dc3fb276768c72db8e2d21e7674ac02e00d9aefbf8b1313e1851973af37cd4bed27a9c234c555326c6b3
-
SSDEEP
393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgu96l+ZArYsFRlH:R3on1HvSzxAMNuFZArYs/
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1SIP and Trust Provider Hijacking
1