9d80eb02ef8ce14dc9d911920068bcaddf464663256592293c0e8fcfe4f4c745

General

Target
fm_protected (2).exe
Size 6.5MB
Sample260930-rlatmavclb
SHA256 9d80eb02ef8ce14dc9d911920068bcaddf464663256592293c0e8fcfe4f4c745
MD5 7c5000b5e8db7d69ed8447ef8d560c31
SHA1 e4b1c612a246579c1e3b5970299c93a39cc4b80a
SHA512 43da451c9f78f2a9ffc14f93d92df935bbf446f6a93303b5d51258609c0f265d13bc217f69dfe1d534ae4ccfd8f5bac8a7068437ec89d42a6a73f06a7557b1fa
SSDEEP 98304:DHyCNy3/7sfkc6VuOuFkcFtHOnWvgf0OBhHmA7irr0NbmmUynKs2JmufXlRzUYTB:DSCNyTLcD8tt+61NKs2JxfP7Tl/P
TLSH
T17966332E71D9E881ED6520FC4637A89B3D437E6C3193B00461243ED94E3737AA9A53E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  fm_protected (2).exe
- Size 6.5MB
- SHA256 9d80eb02ef8ce14dc9d911920068bcaddf464663256592293c0e8fcfe4f4c745
- MD5 7c5000b5e8db7d69ed8447ef8d560c31
- SHA1 e4b1c612a246579c1e3b5970299c93a39cc4b80a
- SHA512 43da451c9f78f2a9ffc14f93d92df935bbf446f6a93303b5d51258609c0f265d13bc217f69dfe1d534ae4ccfd8f5bac8a7068437ec89d42a6a73f06a7557b1fa
- SSDEEP 98304:DHyCNy3/7sfkc6VuOuFkcFtHOnWvgf0OBhHmA7irr0NbmmUynKs2JmufXlRzUYTB:DSCNyTLcD8tt+61NKs2JxfP7Tl/P
- TLSH
  T17966332E71D9E881ED6520FC4637A89B3D437E6C3193B00461243ED94E3737AA9A53E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit defense_evasion discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Stops running service(s)
  defense_evasion execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2