General

  • Target

    de458fc2a4fc3e3cd36f863bdd62ec5e36289facf92fabb683de72343c7f731f

  • Size

    931KB

  • Sample

    210518-abxj99p91j

  • MD5

    d7eb33ddd95d696c2778f8d362a7ca26

  • SHA1

    85951f84dd8825b4ad6397fc260a8a90bfd61518

  • SHA256

    de458fc2a4fc3e3cd36f863bdd62ec5e36289facf92fabb683de72343c7f731f

  • SHA512

    683951080bd05f527fcbccef34c9ff52ae85f7d8387d3986d2702839634e27e330a6d16bba74c890002cc4a6e828d1c7d1c8417782f1c8a3d029849b301fe7af

Malware Config

Targets

    • Target

      de458fc2a4fc3e3cd36f863bdd62ec5e36289facf92fabb683de72343c7f731f

    • Size

      931KB

    • MD5

      d7eb33ddd95d696c2778f8d362a7ca26

    • SHA1

      85951f84dd8825b4ad6397fc260a8a90bfd61518

    • SHA256

      de458fc2a4fc3e3cd36f863bdd62ec5e36289facf92fabb683de72343c7f731f

    • SHA512

      683951080bd05f527fcbccef34c9ff52ae85f7d8387d3986d2702839634e27e330a6d16bba74c890002cc4a6e828d1c7d1c8417782f1c8a3d029849b301fe7af

    • Modifies WinLogon for persistence

    • Modifies system executable filetype association

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

2
T1004

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

2
T1060

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

6
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks