45b74a50c20e74c1b41f3f35d10725971d74fcdaf077c06cbe51f2784e741315 | Triage

Submit
Reports

Overview

overview

8

Static

static

45b74a50c2...15.exe

windows7-x64

8

45b74a50c2...15.exe

windows10-2004-x64

8

Sharing

General

Target

45b74a50c20e74c1b41f3f35d10725971d74fcdaf077c06cbe51f2784e741315
Size

25.1MB
Sample

221103-3baawsgfc9
MD5

b4775fcffd1877ffa155fffc0832cbd8
SHA1

c1e419c89fbd9aadcd1d436ec2c98f3be1db8dad
SHA256

45b74a50c20e74c1b41f3f35d10725971d74fcdaf077c06cbe51f2784e741315
SHA512

6c697f8df1d5e3395b3caa8bc89c1e74706c23cef21cbf7abb62efaebeb02c09228e4079d62a7e65f56a6232f9b85ba9fb1e174772313a574e03d91df3b4e8e0
SSDEEP

786432:d3GJ4ZidZLnUH8ANG3Yjonnb1f5VgXoPq:cqyLnKFgbx5VgYPq

Score

8^/10

discovery evasion exploit persistence

Static task

static1

Behavioral task

behavioral1

Sample

45b74a50c20e74c1b41f3f35d10725971d74fcdaf077c06cbe51f2784e741315.exe

Resource

win7-20220901-en

discovery evasion exploit persistence

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

45b74a50c20e74c1b41f3f35d10725971d74fcdaf077c06cbe51f2784e741315.exe

Resource

win10v2004-20220812-en

discovery evasion exploit persistence

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  45b74a50c20e74c1b41f3f35d10725971d74fcdaf077c06cbe51f2784e741315
- Size
  
  25.1MB
- MD5
  
  b4775fcffd1877ffa155fffc0832cbd8
- SHA1
  
  c1e419c89fbd9aadcd1d436ec2c98f3be1db8dad
- SHA256
  
  45b74a50c20e74c1b41f3f35d10725971d74fcdaf077c06cbe51f2784e741315
- SHA512
  
  6c697f8df1d5e3395b3caa8bc89c1e74706c23cef21cbf7abb62efaebeb02c09228e4079d62a7e65f56a6232f9b85ba9fb1e174772313a574e03d91df3b4e8e0
- SSDEEP
  
  786432:d3GJ4ZidZLnUH8ANG3Yjonnb1f5VgXoPq:cqyLnKFgbx5VgYPq
Score

8^/10

discovery evasion exploit persistence
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Registers COM server for autorun
  persistence
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Modify Existing Service

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Impair Defenses

File Permissions Modification

Modify Registry

Hidden Files and Directories

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexploitpersistence

behavioral2

discoveryevasionexploitpersistence

© 2018-2024

Terms | Privacy