Overview

overview

10

Static

static

W3Mfc.dll

windows7_x64

10

W3Mfc.dll

windows10-2004_x64

8

Resubmissions

04/05/2022, 15:23

220504-ssj7baghdk10

16/12/2021, 09:49

211216-ltb4rscecl3

Sharing

Copy URL Twitter E-mail

General

  • Target
    W3Mfc.DLL
  • Size 244KB
  • Sample220504-ssj7baghdk
  • SHA256 eb88869b7f1bc3f33bb3cd56d6cf4d81fbb0beb590cb9678cc1acf3206f3056f
  • MD5 SHA1 SHA512
Score
10/10
evasionpersistencesuricatatrojanupx

Malware Config

Targets

    • Target
      W3Mfc.DLL
    • Size 244KB
    • SHA256 eb88869b7f1bc3f33bb3cd56d6cf4d81fbb0beb590cb9678cc1acf3206f3056f
    • MD5 SHA1 SHA512
    Score
    10/10
    evasionpersistencesuricatatrojanupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • suricata: ET MALWARE DNS Reply Sinkhole Microsoft NO-IP Domain

      suricata: ET MALWARE DNS Reply Sinkhole Microsoft NO-IP Domain

      suricata

    • suricata: ET MALWARE Win32/Ramnit Checkin

      suricata: ET MALWARE Win32/Ramnit Checkin

      suricata

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks