Overview

overview

10

Static

static

f91d40728c...43.exe

windows7-x64

10

f91d40728c...43.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f91d40728c76bb7a02278fac17c8dd6abd22c15619f352049abbaf752239e043

  • Size

    156KB

  • Sample

    221201-tec2hshd2w

  • MD5

    ba122d153e67c1210c74f4bb61329cdd

  • SHA1

    267d8f3d3057d5ac605e5c712ee17e99f1668b4b

  • SHA256

    f91d40728c76bb7a02278fac17c8dd6abd22c15619f352049abbaf752239e043

  • SHA512

    be4e68c3dc0458dd07b21d8a6f80a49adb5842118a162d74d0093c621671228023622cbcac8e16a2aebc24d9b5d9d614912f96155cabe7f68b06bfba6675c476

  • SSDEEP

    3072:YU++H0toE9revmSgigyAIKYqHxb0NOvTAIb25aQ9OVv:r/4/igyAN/Rb0YTd25atV

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      f91d40728c76bb7a02278fac17c8dd6abd22c15619f352049abbaf752239e043

    • Size

      156KB

    • MD5

      ba122d153e67c1210c74f4bb61329cdd

    • SHA1

      267d8f3d3057d5ac605e5c712ee17e99f1668b4b

    • SHA256

      f91d40728c76bb7a02278fac17c8dd6abd22c15619f352049abbaf752239e043

    • SHA512

      be4e68c3dc0458dd07b21d8a6f80a49adb5842118a162d74d0093c621671228023622cbcac8e16a2aebc24d9b5d9d614912f96155cabe7f68b06bfba6675c476

    • SSDEEP

      3072:YU++H0toE9revmSgigyAIKYqHxb0NOvTAIb25aQ9OVv:r/4/igyAN/Rb0YTd25atV

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks