Overview

overview

6

Static

static

3

b3e7b7563c...8a.exe

windows7-x64

6

b3e7b7563c...8a.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a

  • Size

    178KB

  • Sample

    240701-b5m1aswblk

  • MD5

    7c72fa73b9c245055a395575a827d301

  • SHA1

    41e22780dffed09ee4564592d92bb7e1d762cf96

  • SHA256

    b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a

  • SHA512

    fb38e805a83f6ba99da6ab406764644afa677eb4d081c1f01d507b23793d6768a9616ec0e3a69a8701b6c3bb48f576bbcea6bc39ba23e3dfbc0f36805f378aff

  • SSDEEP

    3072:Z64MKbOFxL/xjzq+5BUaFPmgRMNlPTGQQm6ytwZEsrYkK4Py6u3OD:Z64dc/B98gWNlPTGQQm6agrdF

Score
6/10
bootkitpersistence

Malware Config

Targets

    • Target

      b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a

    • Size

      178KB

    • MD5

      7c72fa73b9c245055a395575a827d301

    • SHA1

      41e22780dffed09ee4564592d92bb7e1d762cf96

    • SHA256

      b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a

    • SHA512

      fb38e805a83f6ba99da6ab406764644afa677eb4d081c1f01d507b23793d6768a9616ec0e3a69a8701b6c3bb48f576bbcea6bc39ba23e3dfbc0f36805f378aff

    • SSDEEP

      3072:Z64MKbOFxL/xjzq+5BUaFPmgRMNlPTGQQm6ytwZEsrYkK4Py6u3OD:Z64dc/B98gWNlPTGQQm6agrdF

    Score
    6/10
    bootkitpersistence

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks