Overview

overview

10

Static

static

4

deb90f81a8...aa.pdf

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    deb90f81a8bd34bc27eb5f1864adfbfb2a5db9e6d59f5f21c6433be00752cfaa

  • Size

    701KB

  • Sample

    220317-pv8qxadha8

  • MD5

    d2f132452ae442b554bd3f09722b442c

  • SHA1

    ed24751ac3af2b9db775b5155fced9782b8e05e2

  • SHA256

    deb90f81a8bd34bc27eb5f1864adfbfb2a5db9e6d59f5f21c6433be00752cfaa

  • SHA512

    6bb708d092534fccee67fa47bd554ed654f2d1bcb89f01f2363f98fa1ea7ae75038bfc505a40494ee4b97435a9c44473b34f37a17ab4e6957b30bb3f9f16d5e2

Score
10/10
evasionlinkpdfpersistencetrojan

Malware Config

Targets

    • Target

      deb90f81a8bd34bc27eb5f1864adfbfb2a5db9e6d59f5f21c6433be00752cfaa

    • Size

      701KB

    • MD5

      d2f132452ae442b554bd3f09722b442c

    • SHA1

      ed24751ac3af2b9db775b5155fced9782b8e05e2

    • SHA256

      deb90f81a8bd34bc27eb5f1864adfbfb2a5db9e6d59f5f21c6433be00752cfaa

    • SHA512

      6bb708d092534fccee67fa47bd554ed654f2d1bcb89f01f2363f98fa1ea7ae75038bfc505a40494ee4b97435a9c44473b34f37a17ab4e6957b30bb3f9f16d5e2

    Score
    10/10
    evasionpersistencetrojan

    • Registers COM server for autorun

      persistence

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

6
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks