Overview

overview

6

Static

static

9166d75269...f7.exe

windows7-x64

5

9166d75269...f7.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7

  • Size

    1.7MB

  • Sample

    221130-h89rsshe93

  • MD5

    de8f507d8ced9abe1b50ca36361a2de6

  • SHA1

    903c00428f1239fe3c8538d9c3348caa0915c18d

  • SHA256

    9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7

  • SHA512

    700219b20717feea27d20d26e44f3dd11d547f1da21f7cd38c591beecb79790c3ef3b4b2c95de790ec8c6b0b42facad84419802fdc30387d5dcfaef61b96dc23

  • SSDEEP

    24576:b5SuxQf2VotQU1aWyyk4rV9kis/Gu4rEH/Oav6rbVf+iGEF2jnq8gs2hsC5e:b5SucTazBGTm/OacVf+rWKbg5de

Score
6/10
microsoftpersistencephishing

Malware Config

Targets

    • Target

      9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7

    • Size

      1.7MB

    • MD5

      de8f507d8ced9abe1b50ca36361a2de6

    • SHA1

      903c00428f1239fe3c8538d9c3348caa0915c18d

    • SHA256

      9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7

    • SHA512

      700219b20717feea27d20d26e44f3dd11d547f1da21f7cd38c591beecb79790c3ef3b4b2c95de790ec8c6b0b42facad84419802fdc30387d5dcfaef61b96dc23

    • SSDEEP

      24576:b5SuxQf2VotQU1aWyyk4rV9kis/Gu4rEH/Oav6rbVf+iGEF2jnq8gs2hsC5e:b5SucTazBGTm/OacVf+rWKbg5de

    Score
    6/10
    microsoftpersistencephishing

    • Adds Run key to start application

      persistence

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks