Overview

overview

8

Static

static

fd4c392950...cb.exe

windows7-x64

8

fd4c392950...cb.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb

  • Size

    1.2MB

  • Sample

    221128-r9qjzsbf77

  • MD5

    52b140ea6e3079f98a0bee3ed83c0318

  • SHA1

    7eae09b09f6116c0988243a4511c54dc4229fd25

  • SHA256

    fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb

  • SHA512

    a924a9ae4fa7b1b7b2eecddad293aedf38caaa1b1376d1352449f2b7657c08d136b2ac2e53a85cb8555969dd26664fc5a18df0286f227555aec443f8a71893d9

  • SSDEEP

    24576:5s1EV2AnLKFtHjdL9JF4AAG+YNUZuszAnCQTp+FA3V0df3M1xbVAb0mk:iWV2OSZjdT2xYGDzjQF+a3V0dixAb0n

Score
8/10
microsoftpersistencephishing

Malware Config

Targets

    • Target

      fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb

    • Size

      1.2MB

    • MD5

      52b140ea6e3079f98a0bee3ed83c0318

    • SHA1

      7eae09b09f6116c0988243a4511c54dc4229fd25

    • SHA256

      fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb

    • SHA512

      a924a9ae4fa7b1b7b2eecddad293aedf38caaa1b1376d1352449f2b7657c08d136b2ac2e53a85cb8555969dd26664fc5a18df0286f227555aec443f8a71893d9

    • SSDEEP

      24576:5s1EV2AnLKFtHjdL9JF4AAG+YNUZuszAnCQTp+FA3V0df3M1xbVAb0mk:iWV2OSZjdT2xYGDzjQF+a3V0dixAb0n

    Score
    8/10
    persistencemicrosoftphishing

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks