Overview

overview

10

Static

static

acaa285781...43.exe

windows7-x64

10

acaa285781...43.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    acaa285781985593cbffa9bd7f922873a0e054c10d25cdfc484ceb4879b99843

  • Size

    108KB

  • Sample

    221201-2wqypsdc71

  • MD5

    1db17a7a14cf9c685e935621c7fea360

  • SHA1

    41c1ce344645dbfa75093f2be6faafed636054af

  • SHA256

    acaa285781985593cbffa9bd7f922873a0e054c10d25cdfc484ceb4879b99843

  • SHA512

    1d88d41228011b4782b70a444ec1fa0b3cdd622389083366a37c8c0ef020223ef19b3a66dc5661040a38de41dcbddd807bfd78c421c48f11f18b5256671ef47b

  • SSDEEP

    3072:pxMpVbK6gXnVm7wwS1oK1bLeBKW5m/KCOZBdJe19IQC:4KJXtluBdMKTzTV

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      acaa285781985593cbffa9bd7f922873a0e054c10d25cdfc484ceb4879b99843

    • Size

      108KB

    • MD5

      1db17a7a14cf9c685e935621c7fea360

    • SHA1

      41c1ce344645dbfa75093f2be6faafed636054af

    • SHA256

      acaa285781985593cbffa9bd7f922873a0e054c10d25cdfc484ceb4879b99843

    • SHA512

      1d88d41228011b4782b70a444ec1fa0b3cdd622389083366a37c8c0ef020223ef19b3a66dc5661040a38de41dcbddd807bfd78c421c48f11f18b5256671ef47b

    • SSDEEP

      3072:pxMpVbK6gXnVm7wwS1oK1bLeBKW5m/KCOZBdJe19IQC:4KJXtluBdMKTzTV

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks