Overview

overview

9

Static

static

3

pcoptimizer.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pcoptimizer.exe

  • Size

    212KB

  • Sample

    240701-cvfnxatblh

  • MD5

    eeaef69144b4ff2e3fb398bb0c880dbe

  • SHA1

    69c4958b752e615f829cb50846a651b996ec9b9d

  • SHA256

    b308979b80ff6586c755a2e72fb988819ae4b50fb021ab0d1f27b0c6899d2bc1

  • SHA512

    5a5ec302a4f379244e757967c759a988844e35be2edfe19c705641ca3bbaa48d1b948c58046d51fe95a927cbc89539bef583549807bd04a6a4381ebf3d1fb0f9

  • SSDEEP

    6144:at5hBPi0BW69hd1MMdxPe9N9uA069TBZlU25hFDaXb0:atzww69T7q25zDP

Score
9/10
bootkitdefense_evasiondiscoveryevasionexploitpersistenceransomware

Malware Config

Targets

    • Target

      pcoptimizer.exe

    • Size

      212KB

    • MD5

      eeaef69144b4ff2e3fb398bb0c880dbe

    • SHA1

      69c4958b752e615f829cb50846a651b996ec9b9d

    • SHA256

      b308979b80ff6586c755a2e72fb988819ae4b50fb021ab0d1f27b0c6899d2bc1

    • SHA512

      5a5ec302a4f379244e757967c759a988844e35be2edfe19c705641ca3bbaa48d1b948c58046d51fe95a927cbc89539bef583549807bd04a6a4381ebf3d1fb0f9

    • SSDEEP

      6144:at5hBPi0BW69hd1MMdxPe9N9uA069TBZlU25hFDaXb0:atzww69T7q25zDP

    Score
    9/10
    bootkitdefense_evasiondiscoveryevasionexploitpersistenceransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Possible privilege escalation attempt

      exploit

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Resource Development

Reconnaissance

Tasks