Overview

overview

10

Static

static

9d085fe596...43.exe

windows7-x64

10

9d085fe596...43.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d085fe596c5223d3250f38f9bbb0585f8555f281cc07f2ce883aeb806d6cf43

  • Size

    262KB

  • Sample

    221124-1hwflabc43

  • MD5

    dd3d297db386103f447b5eed0e62b408

  • SHA1

    5685ac2294da0581d3e33037b151709d61a98f4b

  • SHA256

    9d085fe596c5223d3250f38f9bbb0585f8555f281cc07f2ce883aeb806d6cf43

  • SHA512

    3feb95985416ca6918e1d7d30bfe848e2019847cbf1ad3db4b194c229747a076945b81c605e368dac10451e0176603320f7d8d835d47fbbc3bc37e4118e4ceaf

  • SSDEEP

    6144:A/bILVvWfZc2yUyfi8j4VtyjXP56OS+I1:A0xWfZc2PJZtyjDPa

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      9d085fe596c5223d3250f38f9bbb0585f8555f281cc07f2ce883aeb806d6cf43

    • Size

      262KB

    • MD5

      dd3d297db386103f447b5eed0e62b408

    • SHA1

      5685ac2294da0581d3e33037b151709d61a98f4b

    • SHA256

      9d085fe596c5223d3250f38f9bbb0585f8555f281cc07f2ce883aeb806d6cf43

    • SHA512

      3feb95985416ca6918e1d7d30bfe848e2019847cbf1ad3db4b194c229747a076945b81c605e368dac10451e0176603320f7d8d835d47fbbc3bc37e4118e4ceaf

    • SSDEEP

      6144:A/bILVvWfZc2yUyfi8j4VtyjXP56OS+I1:A0xWfZc2PJZtyjDPa

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks