Overview

overview

9

Static

static

SmartFix.exe

windows7-x64

8

SmartFix.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SmartFix.exe

  • Size

    23.3MB

  • Sample

    221224-ehzblacg2y

  • MD5

    1768ccc0deda07de5a23e4f9a138608a

  • SHA1

    e75b709cc99a4b022a4ce6a5a652601ef416310b

  • SHA256

    299407103d2cc612912b4a1759f7e458adef3608b437bf04fe61d5c75290c44a

  • SHA512

    d8fbd5b5e99c21b4f7822b9048fc092eebfb3aa4f839460242530ca428fb673d777f2aa58ae5c90f692178b8f025c5d0d226457553638f6e4d43330bcf2eb4cd

  • SSDEEP

    393216:Pz9AEgNa6vJ2HM1u05DbWgf5V101YUOytfXH+jUmP0LqipisIw4A+05YhjmC8O0p:L9AE8J2i3R9NAZOQfXH+gmYpNI6+05Qq

Score
9/10
discoveryevasionexploitransomware

Malware Config

Targets

    • Target

      SmartFix.exe

    • Size

      23.3MB

    • MD5

      1768ccc0deda07de5a23e4f9a138608a

    • SHA1

      e75b709cc99a4b022a4ce6a5a652601ef416310b

    • SHA256

      299407103d2cc612912b4a1759f7e458adef3608b437bf04fe61d5c75290c44a

    • SHA512

      d8fbd5b5e99c21b4f7822b9048fc092eebfb3aa4f839460242530ca428fb673d777f2aa58ae5c90f692178b8f025c5d0d226457553638f6e4d43330bcf2eb4cd

    • SSDEEP

      393216:Pz9AEgNa6vJ2HM1u05DbWgf5V101YUOytfXH+jUmP0LqipisIw4A+05YhjmC8O0p:L9AE8J2i3R9NAZOQfXH+gmYpNI6+05Qq

    Score
    9/10
    discoveryevasionexploitransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Tasks