Overview

overview

9

Static

static

5

18d4b8d6da...d8.exe

windows7-x64

9

18d4b8d6da...d8.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18d4b8d6dacb8f5a881d6923180172521c740d4b0b0d045ff836fa643fa418d8

  • Size

    20.0MB

  • Sample

    221029-ws1e3shda7

  • MD5

    4ca7cafe6d2de606474a142b504f264c

  • SHA1

    4e650e70a609f09b797c905db21d6c3b13031884

  • SHA256

    18d4b8d6dacb8f5a881d6923180172521c740d4b0b0d045ff836fa643fa418d8

  • SHA512

    a0140c14db24db61cccdf7f8751223f53caf097e5b696f89d1cf7fbab957692c08c6c883f8646e7677beafc02cb50d264deee5b4c60007b8500e1ff71f3af4a9

  • SSDEEP

    393216:AEhtnC7xIqhwV/zhly0NKt3YMJ+s4yPcwdzbfrxOG9AiCOIfxu9aDw:NFCjwVMZ4RwJTxBKRf89

Score
9/10
cryptonediscoveryevasionpackerpersistencetrojan

Malware Config

Targets

    • Target

      18d4b8d6dacb8f5a881d6923180172521c740d4b0b0d045ff836fa643fa418d8

    • Size

      20.0MB

    • MD5

      4ca7cafe6d2de606474a142b504f264c

    • SHA1

      4e650e70a609f09b797c905db21d6c3b13031884

    • SHA256

      18d4b8d6dacb8f5a881d6923180172521c740d4b0b0d045ff836fa643fa418d8

    • SHA512

      a0140c14db24db61cccdf7f8751223f53caf097e5b696f89d1cf7fbab957692c08c6c883f8646e7677beafc02cb50d264deee5b4c60007b8500e1ff71f3af4a9

    • SSDEEP

      393216:AEhtnC7xIqhwV/zhly0NKt3YMJ+s4yPcwdzbfrxOG9AiCOIfxu9aDw:NFCjwVMZ4RwJTxBKRf89

    Score
    9/10
    cryptonediscoveryevasionpackerpersistencetrojan

    • CryptOne packer

      Detects CryptOne packer defined in NCC blogpost.

      cryptonepacker

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks