43c515cca1a8890892b572ad8e58e6bc32f8fff2b9540ca116acd26a898582bb | Triage

Sharing

General

Target

43c515cca1a8890892b572ad8e58e6bc32f8fff2b9540ca116acd26a898582bb
Size

10.0MB
Sample

241129-p9zrjs1nhm
MD5

bdf04e6f0595292ff10245420a44a0e8
SHA1

d61854691f0b3bfc0c28d6f8fe4c4f1fecd87e19
SHA256

43c515cca1a8890892b572ad8e58e6bc32f8fff2b9540ca116acd26a898582bb
SHA512

90df546f49c24055a389f641cdff213d3a306e4dcb3c45270d3ea3e48336d18a19b36320ac1a89404aaca6777866156b70e9b7d7a6e746867230120dc2fa4f21
SSDEEP

196608:pPj4U7gJUDzwzILSSWR4tA+NVRDPImrRz2k/IRrhBDtlLckE0qoQ1:pPWwcILSbRN+NVmmrRSk/erDtlLcKqoY

Score

8^/10

bootkit discovery persistence

Malware Config

Targets

- Target
  
  43c515cca1a8890892b572ad8e58e6bc32f8fff2b9540ca116acd26a898582bb
- Size
  
  10.0MB
- MD5
  
  bdf04e6f0595292ff10245420a44a0e8
- SHA1
  
  d61854691f0b3bfc0c28d6f8fe4c4f1fecd87e19
- SHA256
  
  43c515cca1a8890892b572ad8e58e6bc32f8fff2b9540ca116acd26a898582bb
- SHA512
  
  90df546f49c24055a389f641cdff213d3a306e4dcb3c45270d3ea3e48336d18a19b36320ac1a89404aaca6777866156b70e9b7d7a6e746867230120dc2fa4f21
- SSDEEP
  
  196608:pPj4U7gJUDzwzILSSWR4tA+NVRDPImrRz2k/IRrhBDtlLckE0qoQ1:pPWwcILSbRN+NVmmrRSk/erDtlLcKqoY
Score

8^/10

bootkit discovery persistence
- Downloads MZ/PE file
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Browser Information Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bootkitdiscoverypersistence

behavioral2

bootkitdiscoverypersistence