Overview

overview

10

Static

static

a4c33306c9...ad.exe

windows7-x64

10

a4c33306c9...ad.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4c33306c96885a0fd361109abeb119dfb7184626de8b1212c29de6cea98c0ad

  • Size

    217KB

  • Sample

    221125-h5wqrsae99

  • MD5

    e0df9f70ca00e37890f7e40fccfe9ea2

  • SHA1

    1564235ebf363f9a3e070345deee3f57ff11ca69

  • SHA256

    a4c33306c96885a0fd361109abeb119dfb7184626de8b1212c29de6cea98c0ad

  • SHA512

    4994c3b33e4f93b31e2bc3acab96e03dd146ef037029643c105b94008d9ac5d8770a9cecc536b3fe51976dc778ab7a74570749652409da5a925b48ab93773ad8

  • SSDEEP

    3072:kZdTTTcoPU+O2JKLloghCS2uSJ9SzHMOy8UUMhWXsLd2:sdTPNP9TJKLfCSBSNhWXs0

Score
10/10
persistence

Malware Config

Targets

    • Target

      a4c33306c96885a0fd361109abeb119dfb7184626de8b1212c29de6cea98c0ad

    • Size

      217KB

    • MD5

      e0df9f70ca00e37890f7e40fccfe9ea2

    • SHA1

      1564235ebf363f9a3e070345deee3f57ff11ca69

    • SHA256

      a4c33306c96885a0fd361109abeb119dfb7184626de8b1212c29de6cea98c0ad

    • SHA512

      4994c3b33e4f93b31e2bc3acab96e03dd146ef037029643c105b94008d9ac5d8770a9cecc536b3fe51976dc778ab7a74570749652409da5a925b48ab93773ad8

    • SSDEEP

      3072:kZdTTTcoPU+O2JKLloghCS2uSJ9SzHMOy8UUMhWXsLd2:sdTPNP9TJKLfCSBSNhWXs0

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Modifies WinLogon

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

2
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks