Overview

overview

10

Static

static

5de55c6832...92.exe

windows7-x64

10

5de55c6832...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5de55c68325c841463352b7e53b058a65e476579fa8cf7126b9dbc6fc4fddc92

  • Size

    143KB

  • Sample

    221221-mcq22aca92

  • MD5

    193cbda4598fe61c69b538416fb78aa1

  • SHA1

    7f8546a917732a4daf146b818fdb7c14b25df3ba

  • SHA256

    5de55c68325c841463352b7e53b058a65e476579fa8cf7126b9dbc6fc4fddc92

  • SHA512

    9e3cb60b519fb6f81b484048ab9e9b4ec78ef81f30c31807d28e18b8ac91a36e94d0c19e5e09082b1039cbcc4b6ece4189677168c97fe5a6da0fb395adc15e3b

  • SSDEEP

    3072:MTb4+LoQHG9gh9hRgf2WGapffZY36ozdH6oz:ObFLo1aRg+gXZUz

Score
10/10
discoveryevasionexploitpersistence

Malware Config

Targets

    • Target

      5de55c68325c841463352b7e53b058a65e476579fa8cf7126b9dbc6fc4fddc92

    • Size

      143KB

    • MD5

      193cbda4598fe61c69b538416fb78aa1

    • SHA1

      7f8546a917732a4daf146b818fdb7c14b25df3ba

    • SHA256

      5de55c68325c841463352b7e53b058a65e476579fa8cf7126b9dbc6fc4fddc92

    • SHA512

      9e3cb60b519fb6f81b484048ab9e9b4ec78ef81f30c31807d28e18b8ac91a36e94d0c19e5e09082b1039cbcc4b6ece4189677168c97fe5a6da0fb395adc15e3b

    • SSDEEP

      3072:MTb4+LoQHG9gh9hRgf2WGapffZY36ozdH6oz:ObFLo1aRg+gXZUz

    Score
    10/10
    discoveryevasionexploitpersistence

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks