Overview

overview

6

Static

static

3

VIEWDOCUME...02.exe

windows10-2004-x64

6

VIEWDOCUME...02.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...ol.dll

windows10-2004-x64

3

$PLUGINSDI...ol.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

concrt140.dll

windows10-2004-x64

1

concrt140.dll

windows11-ltsc_2024-x64

1

hbrm-updat...25.exe

windows10-2004-x64

1

hbrm-updat...25.exe

windows11-ltsc_2024-x64

1

hbrm-updater-x64.exe

windows10-2004-x64

1

hbrm-updater-x64.exe

windows11-ltsc_2024-x64

1

hbrm-updat...25.exe

windows10-2004-x64

3

hbrm-updat...25.exe

windows11-ltsc_2024-x64

3

hbrm-updater-x86.exe

windows10-2004-x64

3

hbrm-updater-x86.exe

windows11-ltsc_2024-x64

3

hbrm-user-x64.exe

windows10-2004-x64

1

hbrm-user-x64.exe

windows11-ltsc_2024-x64

1

hbrm-user-x86.exe

windows10-2004-x64

3

hbrm-user-x86.exe

windows11-ltsc_2024-x64

3

hbrm-x64.exe

windows10-2004-x64

1

hbrm-x64.exe

windows11-ltsc_2024-x64

1

hbrm-x86.exe

windows10-2004-x64

3

hbrm-x86.exe

windows11-ltsc_2024-x64

3

lib/window...40.dll

windows10-2004-x64

1

lib/window...40.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    VIEWDOCUMENT-PDF_20260702.exe
  • Size 14.6MB
  • Sample260728-16rsbaxeje
  • SHA256 a11529d906ffb2a17d1efdb086a653c1904de989769a42f4639a4dd625c9731c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

Malware Config

Targets

    • Target
      VIEWDOCUMENT-PDF_20260702.exe
    • Size 14.6MB
    • SHA256 a11529d906ffb2a17d1efdb086a653c1904de989769a42f4639a4dd625c9731c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    bootkitdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

    • Modifies Windows Firewall

      defense_evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/AccessControl.dll
    • Size 15KB
    • SHA256 5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/UserInfo.dll
    • Size 4KB
    • SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 7KB
    • SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      concrt140.dll
    • Size 324KB
    • SHA256 d404b49c25cc76dc4c86e1d82fc23799482f6509e85a73ed8177efc320ec0195
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      hbrm-updater-x64-temp-0.3.246.60325.exe
    • Size 7.9MB
    • SHA256 f131f3856d0565414c9620a7c107afef54c06e3e841374042b8dcc4b11c0d790
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      hbrm-updater-x64.exe
    • Size 7.9MB
    • SHA256 f131f3856d0565414c9620a7c107afef54c06e3e841374042b8dcc4b11c0d790
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      hbrm-updater-x86-temp-0.3.246.60325.exe
    • Size 7.5MB
    • SHA256 7ab205cba6b387c82b1a91a7089941c5c79d4668b049c0842e37f16232904917
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      hbrm-updater-x86.exe
    • Size 7.5MB
    • SHA256 7ab205cba6b387c82b1a91a7089941c5c79d4668b049c0842e37f16232904917
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      hbrm-user-x64.exe
    • Size 9.9MB
    • SHA256 9e588c9eb462ab5be3e810367559655435311ae3dc4b9c6cb1a9f9714080b371
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      hbrm-user-x86.exe
    • Size 9.5MB
    • SHA256 54178abdfd208b6805811b0799c18d458cbd0d3dfe185d83fdc0160d4c57c862
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      hbrm-x64.exe
    • Size 10.2MB
    • SHA256 0518dbc3420722234e192586edbc465ac47d1b538296bbd8c94895c46882d940
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      hbrm-x86.exe
    • Size 9.8MB
    • SHA256 950f47a935700e6e5aef67793f0355c9dd0bbc40bebef83c8648ddaec7cc1647
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      lib/windows/amd64/concrt140.dll
    • Size 324KB
    • SHA256 d404b49c25cc76dc4c86e1d82fc23799482f6509e85a73ed8177efc320ec0195
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

bootkitdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan
Score
6/10

behavioral2

bootkitdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan
Score
6/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

Score
1/10

behavioral32

Score
1/10