Overview

overview

8

Static

static

4c316c9eb1...e0.exe

windows7-x64

8

4c316c9eb1...e0.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0
  • Size 329KB
  • Sample221127-tk2l3aae82
  • SHA256 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
adwarediscoveryexploitpersistencestealer

Malware Config

Targets

    • Target
      4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0
    • Size 329KB
    • SHA256 4c316c9eb117f7cc8084f04098a5f03469690bc4fe4a449ae369a4b6ec49a9e0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    adwarediscoveryexploitpersistencestealer

    • Drops file in Drivers directory

    • Possible privilege escalation attempt

      exploit

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Modifies file permissions

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks