Overview

overview

10

Static

static

605adae3ed...22.exe

windows7-x64

10

605adae3ed...22.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    605adae3ed62fc9fd1a55b84dc40c5005306ccaf526911b38e9983f835cf5b22

  • Size

    302KB

  • Sample

    221127-yc2z3shb8t

  • MD5

    16feb5f99c1c6f82b51e5187e927cc34

  • SHA1

    2f0334209cb150d6c6e0ed7e20f97030a03d69db

  • SHA256

    605adae3ed62fc9fd1a55b84dc40c5005306ccaf526911b38e9983f835cf5b22

  • SHA512

    7d647f501f6cf7caafa3cbfd627649dc9fbc3d723155e1484a21256ec2952c9060ff1dc97aa3c4ff3eedfcc510be43500d97483c4c6bc9597cba8c0e4832d1c4

  • SSDEEP

    3072:POFIJ3oVdvoiK7+YoPgWVJooHAUnbEnHxl4BjuHWiMEmQVnDhq6NiM3F8A31i9GT:PcIhovoH+MWDoLEWeEmqDDNjF8o0otL

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      605adae3ed62fc9fd1a55b84dc40c5005306ccaf526911b38e9983f835cf5b22

    • Size

      302KB

    • MD5

      16feb5f99c1c6f82b51e5187e927cc34

    • SHA1

      2f0334209cb150d6c6e0ed7e20f97030a03d69db

    • SHA256

      605adae3ed62fc9fd1a55b84dc40c5005306ccaf526911b38e9983f835cf5b22

    • SHA512

      7d647f501f6cf7caafa3cbfd627649dc9fbc3d723155e1484a21256ec2952c9060ff1dc97aa3c4ff3eedfcc510be43500d97483c4c6bc9597cba8c0e4832d1c4

    • SSDEEP

      3072:POFIJ3oVdvoiK7+YoPgWVJooHAUnbEnHxl4BjuHWiMEmQVnDhq6NiM3F8A31i9GT:PcIhovoH+MWDoLEWeEmqDDNjF8o0otL

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks