Overview

overview

8

Static

static

user.scr

windows7-x64

8

user.scr

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    ff6d1c4dfca90f9e63350012376e735c8eef0c0f0600218f174db4748592e536

  • Size

    384KB

  • Sample

    221206-3fmf1sdh66

  • MD5

    050d9b3f6814db7907c0b412f89b3922

  • SHA1

    640babf29fd2febedbeced971b159c2d56bee353

  • SHA256

    ff6d1c4dfca90f9e63350012376e735c8eef0c0f0600218f174db4748592e536

  • SHA512

    8447033b0f74929772234119b03a4e892a07532df5a9818a56b4f3949ab6d07201925696841b7ccdcc5c4ae663585074d5017a45c781ec56130dd9d594826f59

  • SSDEEP

    6144:Fgudn45tm1J04i4jA3HKhyFCQZ57JbP0glX1WMYesP1bZvgtb:Fga9XDi4CBFCgFbPfSesZZgtb

Score
8/10
collectionevasionpersistence

Malware Config

Targets

    • Target

      user.scr

    • Size

      495KB

    • MD5

      d4baefe0cbd11c9aa2f8f0de171fe053

    • SHA1

      68aea47cf611bd6a4398a633c6e2330ff771b778

    • SHA256

      4a6c0e84e83de3dc7c534f57bfcdca85006aeb41c2ce8edfcccc28165765c874

    • SHA512

      96711e202865c101fae4017eaadb4eeb621e10204c38a6f7592202770df614286df185bc491355776fa617ef408e3882397aa6fab5de097386333e815f38cdc0

    • SSDEEP

      6144:0BaZA6AM5tm1BS4i4jARHKhyFxQZZxbUP10glX1WMYesP9bZGgt:0cA6SbVi42BFx8dUP1fweshYgt

    Score
    8/10
    collectionevasionpersistence

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks