Overview

overview

10

Static

static

10

a259e9b0ac...ec.dll

windows10-2004_x64

10

Resubmissions

05-07-2022 07:40

220705-jhsahafbap 10

04-07-2022 19:01

220704-xphxascgf8 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec.zip

  • Size

    487KB

  • Sample

    220704-xphxascgf8

  • MD5

    e4619510458ce472b31702cb625753d7

  • SHA1

    526fbbad182b218351817c43ca80a3171e8ee58e

  • SHA256

    b8f7abca3b0147fa30f3f0fcf63a1e2426ee4f0b6d07ef2155f02aac87cf41fe

  • SHA512

    8570f60d33659edab9072377be72128bed9fd610756f5f59f729f5be5833e1cb822e277951e742f78f32cd1793424bae6bceb42565e6c92bef03972da41dd4df

Score
10/10
hermeticwiperdiscoverypersistenceworm

Malware Config

Targets

    • Target

      a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec.dll

    • Size

      682KB

    • MD5

      517d2b385b846d6ea13b75b8adceb061

    • SHA1

      3c54c9a49a8ddca02189fe15fea52fe24f41a86f

    • SHA256

      a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec

    • SHA512

      1de912f50b7f5cc2f4fcea7b6d3c84a39bd15d668122f50a9b11da66447ed99f456e86e006d0dfe7ab0fca7dc8e35efa7ff57959033463d94ef37e5705515430

    Score
    10/10
    discoverypersistence

    • Modifies system executable filetype association

      persistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks