Overview

overview

10

Static

static

572f723857...2e.exe

windows7-x64

10

572f723857...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    572f7238571336e3f959e28512137e918a83cc9eb3e12abe948604f06c75462e

  • Size

    205KB

  • Sample

    221123-mractseg75

  • MD5

    39cf504957563c7ec7f34b6b239ab8be

  • SHA1

    51b97d4124088699318132eb1bf61be364d364e9

  • SHA256

    572f7238571336e3f959e28512137e918a83cc9eb3e12abe948604f06c75462e

  • SHA512

    93f2476ed58aea38f1e1ee069c91c2eb4a86ec9a7bfb2c75ff5a8b2d62717196481d0ee58ab5abfd6d49a5676ffe847cc761cb6e5335d478bdd0c8f86862745e

  • SSDEEP

    3072:dqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:dqhMPssRARoiSoS3SsQLH5AK

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      572f7238571336e3f959e28512137e918a83cc9eb3e12abe948604f06c75462e

    • Size

      205KB

    • MD5

      39cf504957563c7ec7f34b6b239ab8be

    • SHA1

      51b97d4124088699318132eb1bf61be364d364e9

    • SHA256

      572f7238571336e3f959e28512137e918a83cc9eb3e12abe948604f06c75462e

    • SHA512

      93f2476ed58aea38f1e1ee069c91c2eb4a86ec9a7bfb2c75ff5a8b2d62717196481d0ee58ab5abfd6d49a5676ffe847cc761cb6e5335d478bdd0c8f86862745e

    • SSDEEP

      3072:dqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:dqhMPssRARoiSoS3SsQLH5AK

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies system executable filetype association

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks