Overview

overview

8

Static

static

34f80163bd...a9.exe

windows7_x64

1

34f80163bd...a9.exe

windows10_x64

1

3befc90b32...b3.exe

windows7_x64

1

3befc90b32...b3.exe

windows10_x64

1

409b8d4d4b...3e.exe

windows7_x64

1

409b8d4d4b...3e.exe

windows10_x64

1

485a1b8434...47.exe

windows7_x64

8

485a1b8434...47.exe

windows10_x64

8

4e000f7c66...68.exe

windows7_x64

8

4e000f7c66...68.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Local Virus Copies.zip

  • Size

    15.4MB

  • Sample

    210114-bqhxv5zpxs

  • MD5

    96e1b45b62e6e8988707222430bdd006

  • SHA1

    9feaa80e4f30c08eb484150016edd43e9aafe28d

  • SHA256

    2db131a19b56e70ea942cc12d0ce7732c20a27284f1e44c25e7be8b164e6bcfd

  • SHA512

    7a09659330c91902a70a81349ac3700fc6f9b607d0f0ebf2442c49bf3503d61cf8fe645420401d5daecd9866b534700c0e0b0331e5cb4af81c813cc0aca0003c

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      34f80163bd985506c7f1995bbdf9ec1c66a961f72b516e0476237afe200cd8a9

    • Size

      7.1MB

    • MD5

      dd00622592a7162c07047d47990f3908

    • SHA1

      05d106d31a0b3a74d0d1472a5d9b2f32a4aacd87

    • SHA256

      34f80163bd985506c7f1995bbdf9ec1c66a961f72b516e0476237afe200cd8a9

    • SHA512

      0017c98eea1afffc8f5430ac7820379eb9a19bdde8c141b16952009cd8b0b15d4e4476fe40dddc59bc4911ae5980addde11a99d287477ab82c26c3f671c9e29f

    Score
    1/10
    behavioral1behavioral2

    • Target

      3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3

    • Size

      1.4MB

    • MD5

      0df8e282fcc2f29768fa1c09f5ebea66

    • SHA1

      3f2b2c198c8fb32047920924695b8ccc01efb001

    • SHA256

      3befc90b32cbd8c426c62d8e0a6f62754b7cf336d807c763e224fae0767d74b3

    • SHA512

      34de4f6bbb6967d13ac1912693519457d22d372bd1928724d40ee6c15893fe0675f48a7d3221da35439c398b0f08c5b0dc958d80020b62cabb382846b3308f88

    Score
    1/10
    behavioral3behavioral4

    • Target

      409b8d4d4b4a95003d90feda318a45b408222cb1e0e8cc0526e92ec281c47a3e

    • Size

      2.9MB

    • MD5

      7d148f513069a00daf52aae5e6f003f6

    • SHA1

      4b1912d234bf2d5707bc8694afe28e6468f4b52e

    • SHA256

      409b8d4d4b4a95003d90feda318a45b408222cb1e0e8cc0526e92ec281c47a3e

    • SHA512

      166a2e8f1f2652229f6a778eb6a996a6a6e719c61a25685e81cb0a12c02ea5ac45225dd2591263990fc755780b7328654d4fa357d17c76d1aa138ee87ceb0909

    Score
    1/10
    behavioral5behavioral6

    • Target

      485a1b8434faa85a92902ea3308e6c438754edec4d97061f91f2984a0e64f947

    • Size

      4.6MB

    • MD5

      e06b042633f6a51515699ab3175e585a

    • SHA1

      918e691020ce6dd6ae3275a0c468fc80986cbf25

    • SHA256

      485a1b8434faa85a92902ea3308e6c438754edec4d97061f91f2984a0e64f947

    • SHA512

      7bb3b6d2f8833f373e023c558107359db43f10dc874ff42db2e7ec9f14f6220a20cded68bb68dd29a319c26e79ae4e681e566cf707d31e23f36d93878fe0cba4

    Score
    8/10
    discoverypersistence

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • JavaScript code in executable

    • Drops file in System32 directory

    behavioral7behavioral8

    • Target

      4e000f7c6675b883ccd174048d767cd3d75d61b9a7f56bae0563b2aa7fd26968

    • Size

      960KB

    • MD5

      e6d4229515f9061d7466938755882218

    • SHA1

      f7e99f537877481d8d975b93254002401e8c9359

    • SHA256

      4e000f7c6675b883ccd174048d767cd3d75d61b9a7f56bae0563b2aa7fd26968

    • SHA512

      8235d7dd400c6f38074c8ded1204224271139314aae223f5feebdbc3da06c123eb284827fa6d8035a27104b543db517b96dc6cd34cd143c510f7bf4ff22a0bdf

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral9behavioral10

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Remote System Discovery

2
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks