Overview

overview

8

Static

static

98c261fc57...f5.exe

windows7_x64

98c261fc57...f5.exe

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98c261fc578802232657c1bec8befeff60ec897a1aebfd87f0658b9d694bf7f5

  • Size

    949KB

  • Sample

    210114-ca1p97hxex

  • MD5

    4ac96b4bc751beb32bff1b85f1b0668e

  • SHA1

    f6fb3ba4b9980d2added4b5f106a99fe357658e8

  • SHA256

    98c261fc578802232657c1bec8befeff60ec897a1aebfd87f0658b9d694bf7f5

  • SHA512

    53ffa9b7f77f1c37a9d5212bd34f733644d51444a6839a04e5fb1b04178a98a5753bf4a3cd71c854b1d47b9ec89d7d6b57f6911f534633fb1572816a10ebdbaa

Score
8/10
bootkitdiscoverypersistenceransomwarespyware

Malware Config

Targets

    • Target

      98c261fc578802232657c1bec8befeff60ec897a1aebfd87f0658b9d694bf7f5

    • Size

      949KB

    • MD5

      4ac96b4bc751beb32bff1b85f1b0668e

    • SHA1

      f6fb3ba4b9980d2added4b5f106a99fe357658e8

    • SHA256

      98c261fc578802232657c1bec8befeff60ec897a1aebfd87f0658b9d694bf7f5

    • SHA512

      53ffa9b7f77f1c37a9d5212bd34f733644d51444a6839a04e5fb1b04178a98a5753bf4a3cd71c854b1d47b9ec89d7d6b57f6911f534633fb1572816a10ebdbaa

    Score
    8/10
    discoverypersistencespywarebootkitransomware

    • Executes dropped EXE

    • Modifies WinLogon to allow AutoLogon

      Enables rebooting of the machine without requiring login credentials.

      ransomwarebootkit

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • JavaScript code in executable

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks