Overview

overview

8

Static

static

3f254afeba...92.exe

windows7-x64

8

3f254afeba...92.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892

  • Size

    597KB

  • Sample

    221126-xvdvjage38

  • MD5

    b7cd1c29f4a7f8bbc1b146fee208219f

  • SHA1

    4416ab99b383fbf28516c0476285391f033c305b

  • SHA256

    3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892

  • SHA512

    02800f466f4a4baaecbac85a7e3a154cd102ee3b872b3f511a703a9c41f83cc1ddac90764a15053e90c29c25663758158fd64cebe9e8c1bb462331f041a65014

  • SSDEEP

    12288:Jat0EAH49n8Bu0s4q8xGc55FnU1zRu14+2J1WJeJ+zHn1cS5eS7lU2HzFqz7UEh:4t24r4qU5M1zx/WJSOn1c3OXzFqkEh

Score
8/10
microsoftpersistencephishing

Malware Config

Targets

    • Target

      3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892

    • Size

      597KB

    • MD5

      b7cd1c29f4a7f8bbc1b146fee208219f

    • SHA1

      4416ab99b383fbf28516c0476285391f033c305b

    • SHA256

      3f254afebac05901cbf13abf469b87a7dad28873c7f4ed65921d153fade92892

    • SHA512

      02800f466f4a4baaecbac85a7e3a154cd102ee3b872b3f511a703a9c41f83cc1ddac90764a15053e90c29c25663758158fd64cebe9e8c1bb462331f041a65014

    • SSDEEP

      12288:Jat0EAH49n8Bu0s4q8xGc55FnU1zRu14+2J1WJeJ+zHn1cS5eS7lU2HzFqz7UEh:4t24r4qU5M1zx/WJSOn1c3OXzFqkEh

    Score
    8/10
    microsoftpersistencephishing

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks