Overview

overview

10

Static

static

f48a7dd16b...b3.exe

windows7_x64

10

f48a7dd16b...b3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3

  • Size

    414KB

  • Sample

    210513-tbpf2yy5px

  • MD5

    bf1583e63f772d707c116cc80c76e3d7

  • SHA1

    7442f1317aeb7fdd6da7274e8abe115f20a5958b

  • SHA256

    f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3

  • SHA512

    b0770e6edeebd12e19a6facb14b7537a88ecfbd5f670cf80a6c4a55ff5bb3f9268e9c7f786b2c6aaffecec663a3b457e8aefbfcc24d05fbec0d542e17d4e04e7

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3

    • Size

      414KB

    • MD5

      bf1583e63f772d707c116cc80c76e3d7

    • SHA1

      7442f1317aeb7fdd6da7274e8abe115f20a5958b

    • SHA256

      f48a7dd16b186a612101118825d9149e5bdbdd73686c30a8fc05352a3e20bcb3

    • SHA512

      b0770e6edeebd12e19a6facb14b7537a88ecfbd5f670cf80a6c4a55ff5bb3f9268e9c7f786b2c6aaffecec663a3b457e8aefbfcc24d05fbec0d542e17d4e04e7

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

5
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks