Overview

overview

7

task1

 

5

task2

 

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a2c8d50a0be5281036cd672c6bb7685c12b51ba9008ef04a7d4ddcaac76c023

  • Size

    497KB

  • Sample

    191025-pk5z6hlet2

  • MD5

    5c811c15e7d32e2791c113cc83a6963e

  • SHA1

    409d9ed25935851112a0a6a1edea167899f5bf41

  • SHA256

    7a2c8d50a0be5281036cd672c6bb7685c12b51ba9008ef04a7d4ddcaac76c023

  • SHA512

    d8616425968672c2109f68da82dd67cc62fdd240d5b6cde20017c54a192952bd18e57e3e0214f48776315d5f624c36ceb0b6d6d3f2f4e60e89a5f3199a438f0a

Score
7/10

Malware Config

Targets

    • Target

      7a2c8d50a0be5281036cd672c6bb7685c12b51ba9008ef04a7d4ddcaac76c023

    • Size

      497KB

    • MD5

      5c811c15e7d32e2791c113cc83a6963e

    • SHA1

      409d9ed25935851112a0a6a1edea167899f5bf41

    • SHA256

      7a2c8d50a0be5281036cd672c6bb7685c12b51ba9008ef04a7d4ddcaac76c023

    • SHA512

      d8616425968672c2109f68da82dd67cc62fdd240d5b6cde20017c54a192952bd18e57e3e0214f48776315d5f624c36ceb0b6d6d3f2f4e60e89a5f3199a438f0a

    Score
    7/10

    • Windows security modification

      evasiontrojan

    • Checks system information in the registry (likely anti-VM)

    • Modifies service

      persistence

    • Suspicious use of SetThreadContext

    task1task2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks