Overview

overview

8

Static

static

1

(no subjec...il.eml

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    (no subject) - [email protected] - Stillwater Area Public Schools Mail.mhtml

  • Size

    4.3MB

  • Sample

    241203-tsszwsylbn

  • MD5

    a1626045dffe5301844c952de610abca

  • SHA1

    43c13ebd2688de0d223ec6d6998213c5c14c5907

  • SHA256

    d489c0c61d29be25e54b757e107d664b878fa7c019ccbbbb8a5e928cbb4529e0

  • SHA512

    14f548f82fed51f52838b7961e2f14cab9b91f03211440d547fe18b7f7dca16bd98b478c087b904073437f87ca7e7a708a34a68213ab84d6284aadb7dc29e6ac

  • SSDEEP

    24576:/UjpY/kRHUgH/Le7/4gHjrA9ekHAFFTFS2zFMVNDBzjIG:MUgH/LedQ1vT

Score
8/10
bootkitdiscoveryevasionpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      (no subject) - [email protected] - Stillwater Area Public Schools Mail.mhtml

    • Size

      4.3MB

    • MD5

      a1626045dffe5301844c952de610abca

    • SHA1

      43c13ebd2688de0d223ec6d6998213c5c14c5907

    • SHA256

      d489c0c61d29be25e54b757e107d664b878fa7c019ccbbbb8a5e928cbb4529e0

    • SHA512

      14f548f82fed51f52838b7961e2f14cab9b91f03211440d547fe18b7f7dca16bd98b478c087b904073437f87ca7e7a708a34a68213ab84d6284aadb7dc29e6ac

    • SSDEEP

      24576:/UjpY/kRHUgH/Le7/4gHjrA9ekHAFFTFS2zFMVNDBzjIG:MUgH/LedQ1vT

    Score
    8/10
    bootkitdiscoveryevasionpersistenceprivilege_escalation

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks