Overview

overview

10

Static

static

d20dbce3fa...49.exe

windows7-x64

10

d20dbce3fa...49.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d20dbce3fa81479b99a80cf9fd7420e4cfbe33b407f067e8c02778920e78d249

  • Size

    100KB

  • Sample

    221107-sw5mesdhc8

  • MD5

    0f4189e46b0ee6646684727e90146a40

  • SHA1

    cf2d160b616d5fd3dc794c3e8d930e0d82e414b5

  • SHA256

    d20dbce3fa81479b99a80cf9fd7420e4cfbe33b407f067e8c02778920e78d249

  • SHA512

    c32d34fda99722cbd320cef807e4167eeec767d38588bf964539576fc8b28f0b3e2841ff7aed70d1398a4a1b3946946cd20a351f03974b0d777a2d04cceb9549

  • SSDEEP

    768:Cy8/987dmJKW+IMcK8jFlEMDwfPaO3MRlppr78ZhTp6LRsPxYevbYm7Emgv35BMC:c985mcHIqfypX78ZJuuPHbYwEm+5

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      d20dbce3fa81479b99a80cf9fd7420e4cfbe33b407f067e8c02778920e78d249

    • Size

      100KB

    • MD5

      0f4189e46b0ee6646684727e90146a40

    • SHA1

      cf2d160b616d5fd3dc794c3e8d930e0d82e414b5

    • SHA256

      d20dbce3fa81479b99a80cf9fd7420e4cfbe33b407f067e8c02778920e78d249

    • SHA512

      c32d34fda99722cbd320cef807e4167eeec767d38588bf964539576fc8b28f0b3e2841ff7aed70d1398a4a1b3946946cd20a351f03974b0d777a2d04cceb9549

    • SSDEEP

      768:Cy8/987dmJKW+IMcK8jFlEMDwfPaO3MRlppr78ZhTp6LRsPxYevbYm7Emgv35BMC:c985mcHIqfypX78ZJuuPHbYwEm+5

    Score
    10/10
    evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables cmd.exe use via registry modification

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks