Overview

overview

10

Static

static

77d33ee80a...06.exe

windows7-x64

10

77d33ee80a...06.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    77d33ee80a700b529bda5d1a90ebe851d2d2e70fa641bb72b1d4a81d57942c06

  • Size

    1016KB

  • Sample

    221123-vgs17abh8x

  • MD5

    417073b2fcb92c9f0b00b610de7a7f70

  • SHA1

    97132931908b1305dbf8bef42036e4f6631458ab

  • SHA256

    77d33ee80a700b529bda5d1a90ebe851d2d2e70fa641bb72b1d4a81d57942c06

  • SHA512

    9d07dbbecd71eb876f90a95e3bbe615b8e3da89f143d0b24dbde8b141719aa36e00879f830b3194596e5f5a6316b3dc3c349fcb409d2336e9d8c49a5046be2c3

  • SSDEEP

    6144:7IXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUKz:7IXsgtvm1De5YlOx6lzBH46Us

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      77d33ee80a700b529bda5d1a90ebe851d2d2e70fa641bb72b1d4a81d57942c06

    • Size

      1016KB

    • MD5

      417073b2fcb92c9f0b00b610de7a7f70

    • SHA1

      97132931908b1305dbf8bef42036e4f6631458ab

    • SHA256

      77d33ee80a700b529bda5d1a90ebe851d2d2e70fa641bb72b1d4a81d57942c06

    • SHA512

      9d07dbbecd71eb876f90a95e3bbe615b8e3da89f143d0b24dbde8b141719aa36e00879f830b3194596e5f5a6316b3dc3c349fcb409d2336e9d8c49a5046be2c3

    • SSDEEP

      6144:7IXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUKz:7IXsgtvm1De5YlOx6lzBH46Us

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks