46d53c2016819a5c1cc86f799b440ad2caf16f60c686df008e5d64f66a29ebc3 | Triage

Sharing

General

Target

46d53c2016819a5c1cc86f799b440ad2caf16f60c686df008e5d64f66a29ebc3
Size

4.8MB
Sample

241119-qdd1mswdrg
MD5

cbddf4fda99c875b9b54ea5731943f04
SHA1

571bbbfd852667cbb96dfcf4e5fd6dec45c7c438
SHA256

46d53c2016819a5c1cc86f799b440ad2caf16f60c686df008e5d64f66a29ebc3
SHA512

fab5b065f989f0438cc9290b79e0a68c80197613033a4d36b0164912971ccb22dc4cf6d3be35649479e8a90284f65857e5b2e454b3b105eefb0f275e6a6882f3
SSDEEP

98304:oVeM4VwHuokyfs8PGcx2HynIiprw0F80XZGyN:+AVw8kx2SnIe84GyN

Score

7^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  46d53c2016819a5c1cc86f799b440ad2caf16f60c686df008e5d64f66a29ebc3
- Size
  
  4.8MB
- MD5
  
  cbddf4fda99c875b9b54ea5731943f04
- SHA1
  
  571bbbfd852667cbb96dfcf4e5fd6dec45c7c438
- SHA256
  
  46d53c2016819a5c1cc86f799b440ad2caf16f60c686df008e5d64f66a29ebc3
- SHA512
  
  fab5b065f989f0438cc9290b79e0a68c80197613033a4d36b0164912971ccb22dc4cf6d3be35649479e8a90284f65857e5b2e454b3b105eefb0f275e6a6882f3
- SSDEEP
  
  98304:oVeM4VwHuokyfs8PGcx2HynIiprw0F80XZGyN:+AVw8kx2SnIe84GyN
Score

7^/10

bootkit discovery persistence
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

bootkitdiscoverypersistence