Overview

overview

10

Static

static

76b96f84cc...29.exe

windows7-x64

10

76b96f84cc...29.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    76b96f84cc26050662758376eb5a66a6b81e2c8b05b718344bb91c8bb8a24e29

  • Size

    160KB

  • Sample

    221106-s3hfgabgbn

  • MD5

    0cc9f444897fee45503629b76279f788

  • SHA1

    6e58732d285bc6b962a2da432b6606d99f9d106a

  • SHA256

    76b96f84cc26050662758376eb5a66a6b81e2c8b05b718344bb91c8bb8a24e29

  • SHA512

    46e3721d683df1898c3cdd8332a52a8a3d89cab574bfb0f003fb853d1ece9e9f86928709d14d93404f87e04b9166ca205d12f4eae2d98432ed04989da30204da

  • SSDEEP

    1536:zmWwat4oIuRXqHQu+QwPyohUXWIcoTgCwHhmHKNKqODN5YlS0pw8:znzt4oIuR6Hv+QwPyohUsuCqxqA1Sr

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      76b96f84cc26050662758376eb5a66a6b81e2c8b05b718344bb91c8bb8a24e29

    • Size

      160KB

    • MD5

      0cc9f444897fee45503629b76279f788

    • SHA1

      6e58732d285bc6b962a2da432b6606d99f9d106a

    • SHA256

      76b96f84cc26050662758376eb5a66a6b81e2c8b05b718344bb91c8bb8a24e29

    • SHA512

      46e3721d683df1898c3cdd8332a52a8a3d89cab574bfb0f003fb853d1ece9e9f86928709d14d93404f87e04b9166ca205d12f4eae2d98432ed04989da30204da

    • SSDEEP

      1536:zmWwat4oIuRXqHQu+QwPyohUXWIcoTgCwHhmHKNKqODN5YlS0pw8:znzt4oIuR6Hv+QwPyohUsuCqxqA1Sr

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies system executable filetype association

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Windows security bypass

      evasiontrojan

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Sets file execution options in registry

      persistence

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks