Overview

overview

8

Static

static

71a13f9ed7...5c.exe

windows7-x64

8

71a13f9ed7...5c.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71a13f9ed74aa03667250ed385a7736076e35f061e5d739502bbb55107e0475c

  • Size

    888KB

  • Sample

    221130-rjvq1sbb6t

  • MD5

    1dc1098b0a80ddb5c7981720866ad9c0

  • SHA1

    6b634f8fadee3f091c0f9c8b2eb19a597ef6b1c0

  • SHA256

    71a13f9ed74aa03667250ed385a7736076e35f061e5d739502bbb55107e0475c

  • SHA512

    33796912ca94e529cf7e70df56919c8653937c447641462428bbaa57ed6265b00cd589195bf6fe4d74c5c7ccce93fd527208875b35eca6c8b91adde325785583

  • SSDEEP

    12288:52JylsKTOeDQ4dvfLKVOTDPc7IudTc67BmN6IN2Irz0vu+agwfUFGwTdr:52JyxqYv5GIQc90InrRxAGK

Score
8/10
microsoftpersistencephishing

Malware Config

Targets

    • Target

      71a13f9ed74aa03667250ed385a7736076e35f061e5d739502bbb55107e0475c

    • Size

      888KB

    • MD5

      1dc1098b0a80ddb5c7981720866ad9c0

    • SHA1

      6b634f8fadee3f091c0f9c8b2eb19a597ef6b1c0

    • SHA256

      71a13f9ed74aa03667250ed385a7736076e35f061e5d739502bbb55107e0475c

    • SHA512

      33796912ca94e529cf7e70df56919c8653937c447641462428bbaa57ed6265b00cd589195bf6fe4d74c5c7ccce93fd527208875b35eca6c8b91adde325785583

    • SSDEEP

      12288:52JylsKTOeDQ4dvfLKVOTDPc7IudTc67BmN6IN2Irz0vu+agwfUFGwTdr:52JyxqYv5GIQc90InrRxAGK

    Score
    8/10
    persistencemicrosoftphishing

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks