Overview

overview

10

Static

static

Setup.exe

windows7_x64

8

Setup.exe

windows7_x64

8

Setup.exe

windows7_x64

8

Setup.exe

windows11_x64

8

Setup.exe

windows10_x64

8

Setup.exe

windows10_x64

8

Setup.exe

windows10_x64

10

Resubmissions

12-09-2021 07:23

210912-h76zhscbc3 10

12-09-2021 07:04

210912-hwe2nafbaq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Setup.exe

  • Size

    10.1MB

  • Sample

    210912-h76zhscbc3

  • MD5

    32d11c996b67786686172b4179c6ee46

  • SHA1

    d99662924b9d260872bba995b233332ee0eab748

  • SHA256

    1d364c185082bf798f4ff21f33b63c84cc1407ca33be17793990190b59d2042c

  • SHA512

    5dd02bf6a325befea5ce450b453376bee609b03df562fafdf6603b9e6c84e534e5d13b42aaacf0a99f0ffdc767d529c63fd073c6cf76e193f6268fb54ce8276b

Score
10/10
persistence

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      10.1MB

    • MD5

      32d11c996b67786686172b4179c6ee46

    • SHA1

      d99662924b9d260872bba995b233332ee0eab748

    • SHA256

      1d364c185082bf798f4ff21f33b63c84cc1407ca33be17793990190b59d2042c

    • SHA512

      5dd02bf6a325befea5ce450b453376bee609b03df562fafdf6603b9e6c84e534e5d13b42aaacf0a99f0ffdc767d529c63fd073c6cf76e193f6268fb54ce8276b

    Score
    10/10
    persistence

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks