Overview

overview

10

Static

static

3731233415...33.exe

windows7_x64

10

3731233415...33.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33

  • Size

    1.3MB

  • Sample

    220705-yxtt7scegq

  • MD5

    03f39d4df6508064da95ed5a273a6979

  • SHA1

    60cb1fa320b0d8ac4082f8af7bf59e54de6b9ccb

  • SHA256

    37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33

  • SHA512

    89212c00bfdc1addfa063d1786c96c3f69d932cdd678f9be3be58dfb89ed571417105ad8034b7ad88d4801f35755a847961f8ff6f1e91c26bf372d8be4da485c

Score
10/10
adwarepersistencesuricataupx

Malware Config

Targets

    • Target

      37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33

    • Size

      1.3MB

    • MD5

      03f39d4df6508064da95ed5a273a6979

    • SHA1

      60cb1fa320b0d8ac4082f8af7bf59e54de6b9ccb

    • SHA256

      37312334158e98e5a3e536b38660de4c83d3a0628115ef7fbc09a15b5f9ccf33

    • SHA512

      89212c00bfdc1addfa063d1786c96c3f69d932cdd678f9be3be58dfb89ed571417105ad8034b7ad88d4801f35755a847961f8ff6f1e91c26bf372d8be4da485c

    Score
    10/10
    adwarepersistencesuricataupx

    • Modifies WinLogon for persistence

      persistence

    • suricata: ET MALWARE DNS Reply Sinkhole Microsoft NO-IP Domain

      suricata: ET MALWARE DNS Reply Sinkhole Microsoft NO-IP Domain

      suricata

    • suricata: ET MALWARE Win32/Ramnit Checkin

      suricata: ET MALWARE Win32/Ramnit Checkin

      suricata

    • Allows Chrome notifications for new domains

      adware

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks