Overview

overview

10

Static

static

5

5bf4f8d9b9...00.exe

windows7-x64

10

5bf4f8d9b9...00.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5bf4f8d9b9287f6ad24df8069426b92b93618cc0f01e649646c8597aed302d00

  • Size

    952KB

  • Sample

    221126-cs2tcsee28

  • MD5

    85709c78ce1c001ec8cc52d8f0853220

  • SHA1

    ca551b4dea51a22839d0339ce7879d87ddb10134

  • SHA256

    5bf4f8d9b9287f6ad24df8069426b92b93618cc0f01e649646c8597aed302d00

  • SHA512

    242c859620eb03a9aa06a2b8e9caa925e5bb4808f7344c01a1641a743af1a8b4f44f42ea1b9cb8d978783800ea8fcfb879621bcc8716c726472161efbd8faf00

  • SSDEEP

    12288:FpqiC/2OGAtkCP4cejGSOpRK3CnIiCSsPK:Fpo/2+ttPJLfpRK3CnHCSo

Score
10/10
persistence

Malware Config

Targets

    • Target

      5bf4f8d9b9287f6ad24df8069426b92b93618cc0f01e649646c8597aed302d00

    • Size

      952KB

    • MD5

      85709c78ce1c001ec8cc52d8f0853220

    • SHA1

      ca551b4dea51a22839d0339ce7879d87ddb10134

    • SHA256

      5bf4f8d9b9287f6ad24df8069426b92b93618cc0f01e649646c8597aed302d00

    • SHA512

      242c859620eb03a9aa06a2b8e9caa925e5bb4808f7344c01a1641a743af1a8b4f44f42ea1b9cb8d978783800ea8fcfb879621bcc8716c726472161efbd8faf00

    • SSDEEP

      12288:FpqiC/2OGAtkCP4cejGSOpRK3CnIiCSsPK:Fpo/2+ttPJLfpRK3CnHCSo

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks