Overview

overview

6

Static

static

ca8c9e5ebe...6b.exe

windows7-x64

6

ca8c9e5ebe...6b.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca8c9e5ebe892b946002ab24950a33fdc81e8535e2920bd40b80e7dfd991ee6b

  • Size

    95KB

  • Sample

    221129-1kz7kadg4y

  • MD5

    7a4942f3d4475a1adf238bfcfc3b8a2c

  • SHA1

    cd4458bc65897d3d02719e33625e265a7d21b18f

  • SHA256

    ca8c9e5ebe892b946002ab24950a33fdc81e8535e2920bd40b80e7dfd991ee6b

  • SHA512

    98d6ae0242724619dacbb18582e7bc986781942aa2d5ba403e050bc159f59a11fa52d68fa31572644c34e4db3f595ce84bb1f3d2d7fcc27dc6c32b06c1c62ce2

  • SSDEEP

    1536:JhXO34c1+8r+l8OiLjDavUqVzcnlt54UiqWm98atcNKH+aBf3Tyl:JheIcHrdOiLjuvU86d4U2HatStah3K

Score
6/10
microsoftpersistencephishing

Malware Config

Targets

    • Target

      ca8c9e5ebe892b946002ab24950a33fdc81e8535e2920bd40b80e7dfd991ee6b

    • Size

      95KB

    • MD5

      7a4942f3d4475a1adf238bfcfc3b8a2c

    • SHA1

      cd4458bc65897d3d02719e33625e265a7d21b18f

    • SHA256

      ca8c9e5ebe892b946002ab24950a33fdc81e8535e2920bd40b80e7dfd991ee6b

    • SHA512

      98d6ae0242724619dacbb18582e7bc986781942aa2d5ba403e050bc159f59a11fa52d68fa31572644c34e4db3f595ce84bb1f3d2d7fcc27dc6c32b06c1c62ce2

    • SSDEEP

      1536:JhXO34c1+8r+l8OiLjDavUqVzcnlt54UiqWm98atcNKH+aBf3Tyl:JheIcHrdOiLjuvU86d4U2HatStah3K

    Score
    6/10
    microsoftpersistencephishing

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks