Overview

overview

8

Static

static

8

619e2715c0...a0.exe

windows7-x64

8

619e2715c0...a0.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0

  • Size

    253KB

  • Sample

    221128-xdq4jagd52

  • MD5

    c1617b172c2d59d518dd34e999866293

  • SHA1

    865f0bbc011f39e89f5eb8b6823fced407c4a5fb

  • SHA256

    619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0

  • SHA512

    2412c449db446e51446b8f0dc66fd65a4bedba91051aa1553442d13d5c8bda1e81265afd33faa183844cb01396f1292aec0b580d784a6020bbbdeebbce634eec

  • SSDEEP

    6144:Hfj70ySzxkvXBfHz6DSLn/9lcLLUJ2lSUt:748fBfHzRPQQU3t

Score
8/10
microsoftpersistencephishingupx

Malware Config

Targets

    • Target

      619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0

    • Size

      253KB

    • MD5

      c1617b172c2d59d518dd34e999866293

    • SHA1

      865f0bbc011f39e89f5eb8b6823fced407c4a5fb

    • SHA256

      619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0

    • SHA512

      2412c449db446e51446b8f0dc66fd65a4bedba91051aa1553442d13d5c8bda1e81265afd33faa183844cb01396f1292aec0b580d784a6020bbbdeebbce634eec

    • SSDEEP

      6144:Hfj70ySzxkvXBfHz6DSLn/9lcLLUJ2lSUt:748fBfHzRPQQU3t

    Score
    8/10
    persistenceupxmicrosoftphishing

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks