Overview

overview

8

Static

static

3

Magnetar.exe

windows7-x64

8

Magnetar.exe

windows10-2004-x64

8

Resubmissions

06-07-2024 10:43

240706-mr94fswfnq 8

06-07-2024 10:40

240706-mqsg1sygjg 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Magnetar.exe

  • Size

    1.1MB

  • Sample

    240706-mqsg1sygjg

  • MD5

    d0e76380e7c1d6efd8768397a5291a35

  • SHA1

    e3861d1d7cb04a41f937a2917ec9fb385d4bdfdf

  • SHA256

    b2c17400a4dc55f4358e3d5ffd6a4ce2f94dad94d6e79d7c0b78319a85ad63b8

  • SHA512

    5c4ef4ace91dd6cac1e897af639d97b4c44b21c8fa81e4ea107a4880395dab2f5a425e08b89917eb9664a4f5cd7374d905008446d61f27a614e259ccd4cc1220

  • SSDEEP

    6144:7bnax+xda+AxQxQq4kT+U2PwEfs52ZPQsrwXrUBEfyT3vm9EwJ019JZ2gouG+tr:b7UgMfu9ezFbdCO90GhQDxskM0

Score
8/10
bootkitdiscoveryexploitpersistence

Malware Config

Targets

    • Target

      Magnetar.exe

    • Size

      1.1MB

    • MD5

      d0e76380e7c1d6efd8768397a5291a35

    • SHA1

      e3861d1d7cb04a41f937a2917ec9fb385d4bdfdf

    • SHA256

      b2c17400a4dc55f4358e3d5ffd6a4ce2f94dad94d6e79d7c0b78319a85ad63b8

    • SHA512

      5c4ef4ace91dd6cac1e897af639d97b4c44b21c8fa81e4ea107a4880395dab2f5a425e08b89917eb9664a4f5cd7374d905008446d61f27a614e259ccd4cc1220

    • SSDEEP

      6144:7bnax+xda+AxQxQq4kT+U2PwEfs52ZPQsrwXrUBEfyT3vm9EwJ019JZ2gouG+tr:b7UgMfu9ezFbdCO90GhQDxskM0

    Score
    8/10
    bootkitdiscoveryexploitpersistence

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Possible privilege escalation attempt

      exploit

    • Modifies file permissions

      discovery

    • Modifies boot configuration data using bcdedit

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

File and Directory Permissions Modification

1
T1222

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks