dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88

Resubmissions

02/09/2021, 11:34

210902-2a1l24jhpa8

09/08/2021, 08:27

210809-p9s63bt58n8

Sharing

Copy URL Twitter E-mail

General

Target
dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88
Size 3.9MB
Sample210809-p9s63bt58n
SHA256 dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88
MD5 0b8b4d1854add7dfc1a27b1e93fb002b
SHA1 38cecb90eb2b89d81db27a988ff09ce20db26e8e
SHA512 746d3f81089bf4210a831b5f5a8bec6fa946fe2cb071eb03cce2702c1e79f198cf40a7eafc89067923282a11d583188c885de8fd7d656367ee0b2ba1b861dd34
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Targets

- Target
  dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88
- Size 3.9MB
- SHA256 dee25db703acc220d63785d7a72cce3817305642f5da1dc6f155d5d693bcde88
- MD5 0b8b4d1854add7dfc1a27b1e93fb002b
- SHA1 38cecb90eb2b89d81db27a988ff09ce20db26e8e
- SHA512 746d3f81089bf4210a831b5f5a8bec6fa946fe2cb071eb03cce2702c1e79f198cf40a7eafc89067923282a11d583188c885de8fd7d656367ee0b2ba1b861dd34
- MD5 SHA1 SHA512
Score

8^/10

discovery exploit persistence
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Possible privilege escalation attempt

Loads dropped DLL

Modifies file permissions

Adds Run key to start application

Enumerates connected drives

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2