Overview

overview

10

Static

static

updatewin1.exe

windows7_x64

10

updatewin1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    updatewin1.zip

  • Size

    144KB

  • Sample

    210405-8s6lsp6qcx

  • MD5

    46c141f9dc926a7e7bef1e09169fcfd6

  • SHA1

    56907da0f4a860e3e31b894f45df2b70a6645576

  • SHA256

    82346af1d5ad5c260c4e46f9fac4e3f01430c30b5b454c0b840e80590569ae99

  • SHA512

    6bc6e79d6f77bf463dde0443533c0a8f927360afaa329e5a01af61a54bcaefbb0394433a828cb3fa8a879c3a50b70c25ca28e4d04297a7a9fb0802a3f07100f7

Score
10/10
evasion

Malware Config

Targets

    • Target

      updatewin1.exe

    • Size

      272KB

    • MD5

      5b4bd24d6240f467bfbc74803c9f15b0

    • SHA1

      c17f98c182d299845c54069872e8137645768a1a

    • SHA256

      14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e

    • SHA512

      a896acc38a6ff9641b0803f0598369c0d4fa8e38da28c1653c57948fe5e3274880d1b2e7959cd1b1da43375a1318b3ba72e13240bf40b27c852ee72bbb16cadc

    Score
    10/10
    evasion

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks