2e80059a92e23f07ece25cd25f4e855cb01c8623a5ca9d8d63756c2273368563

Target
vbehxx.zip
Size 33KB
Sample221010-syaj3acdb3
SHA256 2e80059a92e23f07ece25cd25f4e855cb01c8623a5ca9d8d63756c2273368563
MD5 dfb15c3bdeff52b5b2d88f8cca0b76ff
SHA1 02ce8a26a825cbe44a28820415db10cf5c75cf27
SHA512 b411274f30dd9c71d5bb14a17f4978665d6e8cc45dc379b9f694bca365f69b02828eca7cfa327ae3de654f15169233c3ed430cda1a614ecb659bd23b5327ed1d
SSDEEP 768:YgV76KrqScCf4h4ywSC1/VzXDiAJgwkLF3YwzyrNjP:Yc6Kr27SV1/5z5Hhz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection persistence

Malware Config

Targets

- Target
  fucker script.exe
- Size 104KB
- SHA256 52972a23ab12b95cd51d71741db2cf276749e56030c092e2e4f0907dcb1fbd56
- MD5 db0655efbe0dbdef1df06207f5cb5b5b
- SHA1 a8d48d5c0042ce359178d018c0873e8a7c2f27e8
- SHA512 5adc8463c3e148a66f8afdeefc31f2b3ffeb12b7641584d1d24306b0898da60a8b9b948bb4f9b7d693185f2daa9bd9437b3b84cebc0eabfa84dfcef6938e1704
- SSDEEP 1536:m5iT3FccnYWkyjWpOku3yUyJCbyVAvy7+fRo:3LOcxkyjW3wvHq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection persistence
- Modifies system executable filetype association
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Modifies Installed Components in the registry
  persistence
- Registers COM server for autorun
  persistence
- Accesses Microsoft Outlook profiles
  collection
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Process spawned suspicious child process
  This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Modifies system executable filetype association

Process spawned unexpected child process

Modifies Installed Components in the registry

Registers COM server for autorun

Accesses Microsoft Outlook profiles

Enumerates connected drives

Process spawned suspicious child process

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3