Overview

overview

6

Static

static

9513505659...f9.exe

windows7-x64

5

9513505659...f9.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9

  • Size

    190KB

  • Sample

    221129-cdq4babf3z

  • MD5

    b38e43486d01a84cccde5e4e1239f86e

  • SHA1

    1dba2bb6e1157963d8f8846cddb7b6eac8e17ac5

  • SHA256

    95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9

  • SHA512

    3ad8c288a12103a1f19abe607dd427efa0be86b70c4df92db3a9fc564135f882869e0b3574d21a23c9994dc21a5be3719daa85c2a636b097b938c0a207946ec6

  • SSDEEP

    3072:zfetsEYRfmnCgiKPkDtkFhqmFyzqjLRu3fa2oumGA+DumCp0+TiVHKvrRl9uw4:bekROyD2FUmUqifa9ZEum20+qKvEb

Score
6/10
microsoftpersistencephishing

Malware Config

Targets

    • Target

      95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9

    • Size

      190KB

    • MD5

      b38e43486d01a84cccde5e4e1239f86e

    • SHA1

      1dba2bb6e1157963d8f8846cddb7b6eac8e17ac5

    • SHA256

      95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9

    • SHA512

      3ad8c288a12103a1f19abe607dd427efa0be86b70c4df92db3a9fc564135f882869e0b3574d21a23c9994dc21a5be3719daa85c2a636b097b938c0a207946ec6

    • SSDEEP

      3072:zfetsEYRfmnCgiKPkDtkFhqmFyzqjLRu3fa2oumGA+DumCp0+TiVHKvrRl9uw4:bekROyD2FUmUqifa9ZEum20+qKvEb

    Score
    6/10
    microsoftpersistencephishing

    • Adds Run key to start application

      persistence

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks