Overview

overview

10

Static

static

8

3e6006e1b8...5f.doc

windows7-x64

10

3e6006e1b8...5f.doc

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e6006e1b85b9fb7d1b528384110698d285a16c1a05195484a5ff7b961fb2c5f

  • Size

    91KB

  • Sample

    221126-226w4sfc3x

  • MD5

    65f147a8e8ec2928894a742f644fa584

  • SHA1

    4206466e8f86280ec99dc7f29200052a5673aad9

  • SHA256

    3e6006e1b85b9fb7d1b528384110698d285a16c1a05195484a5ff7b961fb2c5f

  • SHA512

    5d3ba6ff14a5e0974f07dd2274f126d20187a0ffd79bbde7566567244fc58a17c7f31c49b1b8e48b4752abf5a90ba4698e9244356fce5b12cd7c5751b65a7599

  • SSDEEP

    1536:rEf4D35BO2G7XIhpMIubBVK/SkqH0gmqa:IwDnijIhSNza

Score
10/10
evasionmacromacro_on_actionpersistencetrojan

Malware Config

Targets

    • Target

      3e6006e1b85b9fb7d1b528384110698d285a16c1a05195484a5ff7b961fb2c5f

    • Size

      91KB

    • MD5

      65f147a8e8ec2928894a742f644fa584

    • SHA1

      4206466e8f86280ec99dc7f29200052a5673aad9

    • SHA256

      3e6006e1b85b9fb7d1b528384110698d285a16c1a05195484a5ff7b961fb2c5f

    • SHA512

      5d3ba6ff14a5e0974f07dd2274f126d20187a0ffd79bbde7566567244fc58a17c7f31c49b1b8e48b4752abf5a90ba4698e9244356fce5b12cd7c5751b65a7599

    • SSDEEP

      1536:rEf4D35BO2G7XIhpMIubBVK/SkqH0gmqa:IwDnijIhSNza

    Score
    10/10
    evasionpersistencetrojan

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Disables taskbar notifications via registry modification

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

5
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks