4fd4dd6818632c4221ffb25efcfdff2445b6e6152ef9f6bdc142ac2410da21c0 | Triage

Submit
Reports

Overview

overview

Static

static

4fd4dd6818...c0.exe

windows7-x64

4fd4dd6818...c0.exe

windows10-2004-x64

Sharing

General

Target

4fd4dd6818632c4221ffb25efcfdff2445b6e6152ef9f6bdc142ac2410da21c0
Size

631KB
Sample

221014-mrst6sbfhj
MD5

582328886086df5e9a7df47038b89a30
SHA1

faf268f16c470cb7b3c0d485f98265144612bb2e
SHA256

4fd4dd6818632c4221ffb25efcfdff2445b6e6152ef9f6bdc142ac2410da21c0
SHA512

41247c7041778d54a4879734ce8689b628e8e9ce9fa9c227694ea8e965b67a8648a1ba3df34fb47c010e69b79ca5f706b0cf499cc31421713cfa4b3733c53613
SSDEEP

6144:43i8X7pt4Oti0BWmKWIBtOcI9SSbA+cuXhIBM7xXYtyBa:43TdtLW5WIj1YSSdFxIBSXyMa

Score

10^/10

evasion persistence

Static task

static1

Behavioral task

behavioral1

Sample

4fd4dd6818632c4221ffb25efcfdff2445b6e6152ef9f6bdc142ac2410da21c0.exe

Resource

win7-20220812-en

evasion persistence

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

4fd4dd6818632c4221ffb25efcfdff2445b6e6152ef9f6bdc142ac2410da21c0.exe

Resource

win10v2004-20220812-en

evasion persistence

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  4fd4dd6818632c4221ffb25efcfdff2445b6e6152ef9f6bdc142ac2410da21c0
- Size
  
  631KB
- MD5
  
  582328886086df5e9a7df47038b89a30
- SHA1
  
  faf268f16c470cb7b3c0d485f98265144612bb2e
- SHA256
  
  4fd4dd6818632c4221ffb25efcfdff2445b6e6152ef9f6bdc142ac2410da21c0
- SHA512
  
  41247c7041778d54a4879734ce8689b628e8e9ce9fa9c227694ea8e965b67a8648a1ba3df34fb47c010e69b79ca5f706b0cf499cc31421713cfa4b3733c53613
- SSDEEP
  
  6144:43i8X7pt4Oti0BWmKWIBtOcI9SSbA+cuXhIBM7xXYtyBa:43TdtLW5WIj1YSSdFxIBSXyMa
Score

10^/10

evasion persistence
- Modifies WinLogon for persistence
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence

© 2018-2024

Terms | Privacy