Overview

overview

10

Static

static

c407364973...51.exe

windows7-x64

c407364973...51.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51

  • Size

    1.1MB

  • Sample

    221123-l2l9psch27

  • MD5

    b0f346275260bdc8bd399154f3e75ca9

  • SHA1

    a2ea09e08354fee78313e1cbbb51421536254ca3

  • SHA256

    c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51

  • SHA512

    3e12866a8302f99a2c94ddb33aab9d2e1aa3712d1966214639d268fd8d35fed2e0543c8f09503f4a64e28eb87fe1c25a54b1a3078484487ff7713b5b2cd855e7

  • SSDEEP

    24576:0YvwF7N4/z4KgFFUIiXmFyGKTlU5Rk8fnIwR76uH:0YIF70OFFz0GKT25ewguH

Score
10/10
evasionpersistencetrojan

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://84.22.42.134/?0=18&1=0&2=40&3=i&4=7601&5=1&6=0000&7=feknraxeyp

Targets

    • Target

      c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51

    • Size

      1.1MB

    • MD5

      b0f346275260bdc8bd399154f3e75ca9

    • SHA1

      a2ea09e08354fee78313e1cbbb51421536254ca3

    • SHA256

      c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51

    • SHA512

      3e12866a8302f99a2c94ddb33aab9d2e1aa3712d1966214639d268fd8d35fed2e0543c8f09503f4a64e28eb87fe1c25a54b1a3078484487ff7713b5b2cd855e7

    • SSDEEP

      24576:0YvwF7N4/z4KgFFUIiXmFyGKTlU5Rk8fnIwR76uH:0YIF70OFFz0GKT25ewguH

    Score
    10/10
    evasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Sets service image path in registry

      persistence

    • Stops running service(s)

      evasion

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Modify Existing Service

1
T1031

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

5
T1112

Impair Defenses

1
T1562

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks