Overview

overview

10

Static

static

Internet-Win7-30min

windows7_x64

10

Resubmissions

25-06-2021 19:32

210625-6wc8e9cwj2 8

17-01-2021 18:55

210117-eh6j4sptaa 10

22-12-2020 13:14

201222-pnne3mqwlx 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MicrosoftUpdate.hta

  • Size

    26KB

  • Sample

    201222-pnne3mqwlx

  • MD5

    12cd7a34e347311c7f07b5b10adb1266

  • SHA1

    fc35180c4e3f0e95e02b163ddbd79ce4151e3ee4

  • SHA256

    8e911752a92e891fd37232961a6d23e3af83f3ea015389a99df9cad6c9e3f869

  • SHA512

    31e4558f4fa8e9adc1e288b025ad3085f89abf3a89bb6a3857cea773c25cd97efb01cb5e814dc6f91766042f7ce1f007e621b84f09500d3672d5828a584c0e38

Score
10/10
rmsaspackv2discoveryevasionpersistencerattrojanupx

Malware Config

Targets

    • Target

      MicrosoftUpdate.hta

    • Size

      26KB

    • MD5

      12cd7a34e347311c7f07b5b10adb1266

    • SHA1

      fc35180c4e3f0e95e02b163ddbd79ce4151e3ee4

    • SHA256

      8e911752a92e891fd37232961a6d23e3af83f3ea015389a99df9cad6c9e3f869

    • SHA512

      31e4558f4fa8e9adc1e288b025ad3085f89abf3a89bb6a3857cea773c25cd97efb01cb5e814dc6f91766042f7ce1f007e621b84f09500d3672d5828a584c0e38

    Score
    10/10
    rmsaspackv2discoveryevasionpersistencerattrojanupx

    • Modifies WinLogon for persistence

      persistence

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

2
T1060

Hidden Files and Directories

2
T1158

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks