0dfb26cd2eb02c921a9c73c9c5615dfb666cdd33971639d6441eb6893ae2efe1 | Triage

Sharing

General

Target

Docs_7f6f469f6981d4a92806d0d3b706e258.180
Size

127KB
Sample

191216-sqh3yj6ss6
MD5

7f6f469f6981d4a92806d0d3b706e258
SHA1

b62ce47650a8cad8dc922fdf54db41e5c2fc0b4c
SHA256

0dfb26cd2eb02c921a9c73c9c5615dfb666cdd33971639d6441eb6893ae2efe1
SHA512

96ab1419ab38bc0958ab7d0d130efda8302f3f07555753882d28ca19fd0f73a5f781fdf617a741503b8b858dec1d182b08c880c48c5875e672462880b600a8bd

Score

8^/10

evasion trojan

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://lilikhendarwati.com/wp-admin/JbdTQoQQ/

exe.dropper

http://www.zhangboo.com/wp-admin/lwhcvV/

exe.dropper

http://test.windsorheatingandair.com/wp-includes/r9lv-4teq5ff-8759846140/

exe.dropper

https://www.jackiejill.com/wp-includes/yiqr4r6a-dwt7s0u-26965878/

exe.dropper

http://apolina.pl/engl/1tuh6ul-gakf89-994/

Targets

- Target
  
  Docs_7f6f469f6981d4a92806d0d3b706e258.180
- Size
  
  127KB
- MD5
  
  7f6f469f6981d4a92806d0d3b706e258
- SHA1
  
  b62ce47650a8cad8dc922fdf54db41e5c2fc0b4c
- SHA256
  
  0dfb26cd2eb02c921a9c73c9c5615dfb666cdd33971639d6441eb6893ae2efe1
- SHA512
  
  96ab1419ab38bc0958ab7d0d130efda8302f3f07555753882d28ca19fd0f73a5f781fdf617a741503b8b858dec1d182b08c880c48c5875e672462880b600a8bd
Score

8^/10

evasion trojan
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
task1 task2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

task1

dropperexploitermaldoc

task2

dropperexploitermaldoc