Overview

overview

10

Static

static

70cb39ef1e...12.exe

windows7-x64

10

70cb39ef1e...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70cb39ef1ed95e4575fc6bbb4f9c7198324d613e40d41a73e6f8dfe90f314f12

  • Size

    30KB

  • Sample

    221002-2kndfadff6

  • MD5

    71a1a1b553e65e986cda1f7ea4f19c90

  • SHA1

    27a58fd84b9586990d4bb327351ca14a79ed0339

  • SHA256

    70cb39ef1ed95e4575fc6bbb4f9c7198324d613e40d41a73e6f8dfe90f314f12

  • SHA512

    87f5ec59c02f8f7b3630773cbfeb9613763af3dd449b75cec5ad1f8a32cb00fdac931e1143a09d5ce2b55aaf977ad7b9f7155c641f4a183db0e1786a28a53e24

  • SSDEEP

    384:RXEyq7N30i1jg1guDU0XejcjUsBdYR2eK5fuzyrqn92oc/nAzBm3D0KokU:RXE7+yjoDUgBUsBmoGe7ocozU3vokU

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      70cb39ef1ed95e4575fc6bbb4f9c7198324d613e40d41a73e6f8dfe90f314f12

    • Size

      30KB

    • MD5

      71a1a1b553e65e986cda1f7ea4f19c90

    • SHA1

      27a58fd84b9586990d4bb327351ca14a79ed0339

    • SHA256

      70cb39ef1ed95e4575fc6bbb4f9c7198324d613e40d41a73e6f8dfe90f314f12

    • SHA512

      87f5ec59c02f8f7b3630773cbfeb9613763af3dd449b75cec5ad1f8a32cb00fdac931e1143a09d5ce2b55aaf977ad7b9f7155c641f4a183db0e1786a28a53e24

    • SSDEEP

      384:RXEyq7N30i1jg1guDU0XejcjUsBdYR2eK5fuzyrqn92oc/nAzBm3D0KokU:RXE7+yjoDUgBUsBmoGe7ocozU3vokU

    Score
    10/10
    evasionpersistence

    • Modifies system executable filetype association

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks