Overview

overview

8

Static

static

1

Nulle a ch...se.mp3

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nulle a chier la raclette chinois intolerant lactose.mp3

  • Size

    289KB

  • Sample

    240630-wtf3ts1hra

  • MD5

    052e6c0b6f167a7da0515a75bb723a02

  • SHA1

    ba0d45ec867618f2d4e87433d5551e75e739761b

  • SHA256

    5d886595deeeb94565f29a59787970e5fb9db839077941ce63ebb9e5736f0f50

  • SHA512

    d7330abf792ccc82656589ad0922da206bf5421d05dd36b6161d355cffde635aa65333fdf511cbd5d9a230e34d1d0b851bbb919311b88019a91681f632c92c76

  • SSDEEP

    6144:pU004GauSJWLdaeQpIC1R7JWZYPlP2Wvhda7AOP9:pWoWpQzop2hdiAOl

Score
8/10
bootkitpersistence

Malware Config

Targets

    • Target

      Nulle a chier la raclette chinois intolerant lactose.mp3

    • Size

      289KB

    • MD5

      052e6c0b6f167a7da0515a75bb723a02

    • SHA1

      ba0d45ec867618f2d4e87433d5551e75e739761b

    • SHA256

      5d886595deeeb94565f29a59787970e5fb9db839077941ce63ebb9e5736f0f50

    • SHA512

      d7330abf792ccc82656589ad0922da206bf5421d05dd36b6161d355cffde635aa65333fdf511cbd5d9a230e34d1d0b851bbb919311b88019a91681f632c92c76

    • SSDEEP

      6144:pU004GauSJWLdaeQpIC1R7JWZYPlP2Wvhda7AOP9:pWoWpQzop2hdiAOl

    Score
    8/10
    bootkitpersistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Defense Evasion

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

5
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks