Overview

overview

10

Static

static

3

2011-VizSe...es.pdf

windows11_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2011-VizSec-Malware-Images.pdf

  • Size

    3.6MB

  • Sample

    211110-wbwqkafabp

  • MD5

    7b78e9ac838082818c7bfaecfe8aaf1c

  • SHA1

    87ff7ef37bd35d97ea0316398e762cd642df64a6

  • SHA256

    daaa306996365e4f12c89c8e8262d7785eb22c8ac8b2aa077dad328b2db4420e

  • SHA512

    7a3a217c1147dbec728403d84c9989436829221ce66b6f0d28555930a9e18eb66ee176b37f7c8d57a8a90c975c0ad1efbf409dc3e906ae2a90fb461bc10dd042

Score
10/10
linkpdfpersistence

Malware Config

Targets

    • Target

      2011-VizSec-Malware-Images.pdf

    • Size

      3.6MB

    • MD5

      7b78e9ac838082818c7bfaecfe8aaf1c

    • SHA1

      87ff7ef37bd35d97ea0316398e762cd642df64a6

    • SHA256

      daaa306996365e4f12c89c8e8262d7785eb22c8ac8b2aa077dad328b2db4420e

    • SHA512

      7a3a217c1147dbec728403d84c9989436829221ce66b6f0d28555930a9e18eb66ee176b37f7c8d57a8a90c975c0ad1efbf409dc3e906ae2a90fb461bc10dd042

    Score
    10/10
    persistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks