Overview

overview

6

Static

static

3

5ead714595...d8.exe

windows7-x64

6

5ead714595...d8.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5ead71459501e8c5c2068e0149b026bf7ba9b045da0d0de23616401cfb58c4d8

  • Size

    4.3MB

  • Sample

    240630-pkby7a1cpl

  • MD5

    fe91ab55542f1446f7798a979b6406e5

  • SHA1

    806851d741210b25aa085806efd6380a830f4905

  • SHA256

    5ead71459501e8c5c2068e0149b026bf7ba9b045da0d0de23616401cfb58c4d8

  • SHA512

    4b11b60438280283c1a2b1b856a92558a0d6c501f749f56f267d3cad76e6af4ea863957afb29981a6d578458ad711f8d886834d07caa8e3af800f23db746255a

  • SSDEEP

    49152:4GJG+5spujVZ5c4TS03jEvyfrV0RMXEvaOhtlWfD85ImBkCoNZzykP/:npsuZrv8yfrVhXE/htlv5BBNoNty+/

Score
6/10
bootkitpersistence

Malware Config

Targets

    • Target

      5ead71459501e8c5c2068e0149b026bf7ba9b045da0d0de23616401cfb58c4d8

    • Size

      4.3MB

    • MD5

      fe91ab55542f1446f7798a979b6406e5

    • SHA1

      806851d741210b25aa085806efd6380a830f4905

    • SHA256

      5ead71459501e8c5c2068e0149b026bf7ba9b045da0d0de23616401cfb58c4d8

    • SHA512

      4b11b60438280283c1a2b1b856a92558a0d6c501f749f56f267d3cad76e6af4ea863957afb29981a6d578458ad711f8d886834d07caa8e3af800f23db746255a

    • SSDEEP

      49152:4GJG+5spujVZ5c4TS03jEvyfrV0RMXEvaOhtlWfD85ImBkCoNZzykP/:npsuZrv8yfrVhXE/htlv5BBNoNty+/

    Score
    6/10
    bootkitpersistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks