Extracted

• • Target
    VIRUS 63h.rar
  • Size 2.9MB
  • SHA256 5ba40ab0e5903b377fdb0f39c9670ed425d6cb6a34746f2f41579f9f1a2f5f14
  • MD5 3c511ad0b19881741a37c29397118ea2
  • SHA1 e4721b4e7a0aba8e66a06b96360ff90b0906d094
  • SHA512 df686a569e9b3bf90dde2119da5955f1f63d622fed03c9c5e667c1f11365c3e396ae9f34e46276e531d8b433d21121b17a1779d8d24274dc34028d0ba648e159
  • SSDEEP 49152:i/tMDq8zIqaYnojObIrIMtxvAvw54aH84O3ks7MgEmRPjbpFhFJ0ujkVavZGocH3:Q58zIhYM0mIIxOwRb2ks7A4HhFJZv4Bx
  • TLSH
    T1B0E533AB76C633018CF387A310E455021605BD8F6AB287CB1B976EB70DF6B64D23DA05
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  bootkitdiscoveryexecutionpersistenceprivilege_escalationadwareransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2behavioral3behavioral4