Overview

overview

6

Static

static

3

Не по...06.exe

windows10-ltsc_2021-x64

6

$TEMP/AnVir.exe

windows10-ltsc_2021-x64

6

anvir64.exe

windows10-ltsc_2021-x64

1

anvirlauncher.exe

windows10-ltsc_2021-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Не подтверждено 807906.~
  • Size 4.3MB
  • Sample260720-ye7ncae16s
  • SHA256 8507526b209551e01093ef6991491a1ed2ef1bd83a3011a593763d1b2481c858
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdefense_evasiondiscoveryexecutionpersistencespywaretrojan

Malware Config

Targets

    • Target
      Не подтверждено 807906.~
    • Size 4.3MB
    • SHA256 8507526b209551e01093ef6991491a1ed2ef1bd83a3011a593763d1b2481c858
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoveryexecutionpersistence
    behavioral1
    • Target
      $TEMP/AnVir.exe
    • Size 11.2MB
    • SHA256 e0cbf935b59a329b25581611ff509cbae7d023acc4e312f26d0cde43b3f1db40
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdefense_evasiondiscoverypersistencespywaretrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral2
    • Target
      anvir64.exe
    • Size 214KB
    • SHA256 6e8d0df6c01549a9516d33c38b57949e58f4bb873a38dfcfc58b85eea533fae6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      anvirlauncher.exe
    • Size 123KB
    • SHA256 7deb7f8fecdb65250b8f8c2df062534c3377738e73928cab39bdc93eafb8b3d6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks