General

  • Target

    Fri05eeb2dae7b88520a.exe

  • Size

    379KB

  • Sample

    211022-r1bdpscfdr

  • MD5

    9b07fc470646ce890bcb860a5fb55f13

  • SHA1

    ef01d45abaf5060a0b32319e0509968f6be3082f

  • SHA256

    506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b

  • SHA512

    4cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc

Malware Config

Targets

    • Target

      Fri05eeb2dae7b88520a.exe

    • Size

      379KB

    • MD5

      9b07fc470646ce890bcb860a5fb55f13

    • SHA1

      ef01d45abaf5060a0b32319e0509968f6be3082f

    • SHA256

      506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b

    • SHA512

      4cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc

    • Registers COM server for autorun

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets service image path in registry

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Tasks