Overview

overview

10

Static

static

c39c77b001...06.exe

windows7-x64

10

c39c77b001...06.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c39c77b0016195a9bdc4bd077b1b125d2f60cc0016a3f84a68d6c58bf4852e06

  • Size

    920KB

  • Sample

    221003-vdsw1sfeeq

  • MD5

    5c082fea579b6c72d426961c2342c625

  • SHA1

    a6160691d1f1a8408e12c3ae6a58a702b67df05b

  • SHA256

    c39c77b0016195a9bdc4bd077b1b125d2f60cc0016a3f84a68d6c58bf4852e06

  • SHA512

    0eaf60ed57b0a88fc774b28a6c1bc3992c28811805f79debbafeb2abf37b07800609b344268583b73f6e8e0149d773bf8579cdf768ba091eeb864743d840b824

  • SSDEEP

    6144:es0Coo08x5IFkvtcwKuHhPAznhJBy1J5CQSojuQ8SRyYnaNSOuxJ5CQSojuQ8SRW:eIXzFJHm7hD7QuJNYnncQuJrnuYnn

Score
10/10
microsoftevasionpersistencephishing

Malware Config

Targets

    • Target

      c39c77b0016195a9bdc4bd077b1b125d2f60cc0016a3f84a68d6c58bf4852e06

    • Size

      920KB

    • MD5

      5c082fea579b6c72d426961c2342c625

    • SHA1

      a6160691d1f1a8408e12c3ae6a58a702b67df05b

    • SHA256

      c39c77b0016195a9bdc4bd077b1b125d2f60cc0016a3f84a68d6c58bf4852e06

    • SHA512

      0eaf60ed57b0a88fc774b28a6c1bc3992c28811805f79debbafeb2abf37b07800609b344268583b73f6e8e0149d773bf8579cdf768ba091eeb864743d840b824

    • SSDEEP

      6144:es0Coo08x5IFkvtcwKuHhPAznhJBy1J5CQSojuQ8SRyYnaNSOuxJ5CQSojuQ8SRW:eIXzFJHm7hD7QuJNYnncQuJrnuYnn

    Score
    10/10
    evasionpersistencemicrosoftphishing

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks