Overview

overview

8

Static

static

Default

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PaymentReceipt.tar

  • Size

    29KB

  • Sample

    210114-pv11jvx1e2

  • MD5

    7b4b12575d89ab62e64c4ec03ea92f72

  • SHA1

    2077f63fcd87d8e030d4cd0e9650c0c792d7d570

  • SHA256

    96fc19a030de2e853420f5161ba5f85e4cc0b0b8e859e949acb1170fbd51f7d7

  • SHA512

    a7de7a997bc64fe7fe812cdaf1a434a268d678600908dc2515ecb88b3d2dc8b93164d1f4c53c84614c4780dc5b6a82af70092ade228addfa86f2969d6c25f179

Score
8/10
persistence

Malware Config

Targets

    • Target

      PaymentReceipt.js

    • Size

      27KB

    • MD5

      4aefdf76b4e1b9e3902b62ff743f060b

    • SHA1

      7cb6f5a6a6e30353cef6694bae2b56db8cdc0ea6

    • SHA256

      7961f9be4bdb030adaa35da45684612421c5affe460729b1eb0af5432638c25f

    • SHA512

      ce7f2bb4f8787d2e2905a3bb35e2bbe21dbfa52a10fa7e09e941ff8e7f78b0005851a23ff1d70bbfef2fffc5d060d70103276094a760d97ddb53567c74912dbb

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks