Overview

overview

9

Static

static

f8f814e546...3e.exe

windows7-x64

9

f8f814e546...3e.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8f814e546527b238d18e9c57d838a6a480faec42850ec53f3088f821af9bb3e

  • Size

    154KB

  • Sample

    221125-hhrtasgh78

  • MD5

    fde45cb45fe7785ec742e6ce4d7a9287

  • SHA1

    58a943effdad7a11278d9bcfa641c46d39c3337b

  • SHA256

    f8f814e546527b238d18e9c57d838a6a480faec42850ec53f3088f821af9bb3e

  • SHA512

    697dd9c69eb8f53f881544fcf25efad9463f1ae22f6f98de71a1fe1648977491de786e116fe5f5f6d4327e553a3e84d3b4b09abc8b79e455098ded8ec63f1d0d

  • SSDEEP

    3072:j3ROegng8z0q2ye403nLpRgXdJRzJkY3ckYid:VOeHN3n1RgpzJl3ckYk

Score
9/10
cryptonepackerpersistence

Malware Config

Targets

    • Target

      f8f814e546527b238d18e9c57d838a6a480faec42850ec53f3088f821af9bb3e

    • Size

      154KB

    • MD5

      fde45cb45fe7785ec742e6ce4d7a9287

    • SHA1

      58a943effdad7a11278d9bcfa641c46d39c3337b

    • SHA256

      f8f814e546527b238d18e9c57d838a6a480faec42850ec53f3088f821af9bb3e

    • SHA512

      697dd9c69eb8f53f881544fcf25efad9463f1ae22f6f98de71a1fe1648977491de786e116fe5f5f6d4327e553a3e84d3b4b09abc8b79e455098ded8ec63f1d0d

    • SSDEEP

      3072:j3ROegng8z0q2ye403nLpRgXdJRzJkY3ckYid:VOeHN3n1RgpzJl3ckYk

    Score
    9/10
    cryptonepackerpersistence

    • CryptOne packer

      Detects CryptOne packer defined in NCC blogpost.

      cryptonepacker

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks