General

  • Target

    02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c

  • Size

    13KB

  • Sample

    220131-1nsxnadaa7

  • MD5

    341e51206dfcf26c5179cf39417e997a

  • SHA1

    7f0d2f7bcd30c3226a792472612c0273962f6115

  • SHA256

    02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c

  • SHA512

    34ea58a2c93308540182bcd1d612482237d411f62f35f3bb0bf962fac24d02eafa86a7c8327c0539d0043ddf00f7c38f1f1ae04cf9d077c0e6192712cd1226c3

Score
8/10

Malware Config

Targets

    • Target

      02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c

    • Size

      13KB

    • MD5

      341e51206dfcf26c5179cf39417e997a

    • SHA1

      7f0d2f7bcd30c3226a792472612c0273962f6115

    • SHA256

      02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c

    • SHA512

      34ea58a2c93308540182bcd1d612482237d411f62f35f3bb0bf962fac24d02eafa86a7c8327c0539d0043ddf00f7c38f1f1ae04cf9d077c0e6192712cd1226c3

    Score
    8/10
    • Adds policy Run key to start application

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks