Overview

overview

10

task1

 

7

task2

 

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e9389041980d43120d7b705d8690f3f8617d0f91cef50a8de1859394a5e193d

  • Size

    160KB

  • Sample

    191025-prx9tfhw12

  • MD5

    67ea1fd7caee3b4da260cf93b937c0f1

  • SHA1

    1b7efd98ac43839b06d364354d2c8edad6083d20

  • SHA256

    8e9389041980d43120d7b705d8690f3f8617d0f91cef50a8de1859394a5e193d

  • SHA512

    7b20ce698612d6a4aced207006588d4a968abcbfaedc87dea1d2e6eb5768bbeccb098c5e777c62baa54b4a3c25a795b15a9b7b3958b767ec7eb96ec844c13159

Score
10/10

Malware Config

Targets

    • Target

      8e9389041980d43120d7b705d8690f3f8617d0f91cef50a8de1859394a5e193d

    • Size

      160KB

    • MD5

      67ea1fd7caee3b4da260cf93b937c0f1

    • SHA1

      1b7efd98ac43839b06d364354d2c8edad6083d20

    • SHA256

      8e9389041980d43120d7b705d8690f3f8617d0f91cef50a8de1859394a5e193d

    • SHA512

      7b20ce698612d6a4aced207006588d4a968abcbfaedc87dea1d2e6eb5768bbeccb098c5e777c62baa54b4a3c25a795b15a9b7b3958b767ec7eb96ec844c13159

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks processor name in registry (likely anti-VM)

    • Program crash

    • Windows security modification

      evasiontrojan

    • Modifies system certificate store

      evasionspywaretrojan

    • Checks system information in the registry (likely anti-VM)

    • Modifies service

      persistence
    task1task2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks