Overview

overview

9

Static

static

6

FileSetup-...41.exe

windows7_x64

8

FileSetup-...41.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FileSetup-v17.04.41.exe

  • Size

    4.4MB

  • Sample

    210129-97x41ynnl2

  • MD5

    b7234e4a9aaaacefa890535f8117c8fc

  • SHA1

    24c4321111ff004105c14e29662682f16900de29

  • SHA256

    a8fefe8e1f92a30d1cdd4e2e2afaacf08a02c8961f496ee16e89062417ec5f28

  • SHA512

    8590be6433943bec0867a18247e25d9821d39db1d06c6957d3895558eb5568dddff0b97acda222f0a16701c50de43d8ad667d6717add6900ec941e71ca28e513

Score
9/10
bootkitmacropersistencespywarexlm

Malware Config

Targets

    • Target

      FileSetup-v17.04.41.exe

    • Size

      4.4MB

    • MD5

      b7234e4a9aaaacefa890535f8117c8fc

    • SHA1

      24c4321111ff004105c14e29662682f16900de29

    • SHA256

      a8fefe8e1f92a30d1cdd4e2e2afaacf08a02c8961f496ee16e89062417ec5f28

    • SHA512

      8590be6433943bec0867a18247e25d9821d39db1d06c6957d3895558eb5568dddff0b97acda222f0a16701c50de43d8ad667d6717add6900ec941e71ca28e513

    Score
    9/10
    bootkitmacropersistencespywarexlm

    • Nirsoft

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • JavaScript code in executable

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks