Overview

overview

10

Static

static

fce155cc80...7a.exe

windows7-x64

10

fce155cc80...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fce155cc805d8de9a0b557a2954d17db42989f32194e8064c5142f84f110a87a

  • Size

    554KB

  • Sample

    221124-tzvgasfc72

  • MD5

    991bba815629d035d6e4af3d5b4f6f18

  • SHA1

    b180d589824b926781c7475db571044cfe847aed

  • SHA256

    fce155cc805d8de9a0b557a2954d17db42989f32194e8064c5142f84f110a87a

  • SHA512

    64fef690d1ddbcb7b8821f5fbb7df9aa42bbd2400aea3252560d757738338b608f4f5e9f6b6cddf3affdd33e13a6784ddd80cc83a7dc9c66f56689e1389d361d

  • SSDEEP

    6144:fmCH17bxxhXJCuJrrRlOQiQOv8VNHqqSbw5o7pHpzmG3kBz6zO6hSWWVH72YUlKz:/B1xhXJxtxC5E5oPmGUgzO6xWVbVal8

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      fce155cc805d8de9a0b557a2954d17db42989f32194e8064c5142f84f110a87a

    • Size

      554KB

    • MD5

      991bba815629d035d6e4af3d5b4f6f18

    • SHA1

      b180d589824b926781c7475db571044cfe847aed

    • SHA256

      fce155cc805d8de9a0b557a2954d17db42989f32194e8064c5142f84f110a87a

    • SHA512

      64fef690d1ddbcb7b8821f5fbb7df9aa42bbd2400aea3252560d757738338b608f4f5e9f6b6cddf3affdd33e13a6784ddd80cc83a7dc9c66f56689e1389d361d

    • SSDEEP

      6144:fmCH17bxxhXJCuJrrRlOQiQOv8VNHqqSbw5o7pHpzmG3kBz6zO6hSWWVH72YUlKz:/B1xhXJxtxC5E5oPmGUgzO6xWVbVal8

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks