Overview

overview

8

Static

static

intermec_driver.exe

windows10-1703-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    intermec_driver.exe

  • Size

    25.2MB

  • Sample

    221231-v5nflsdc6y

  • MD5

    c3b37f6e7d7c7736ada47d6586ffb795

  • SHA1

    57c02277e11e2c445ef96dd0c6859df16d01219c

  • SHA256

    ff0414790d57b709ef8bacb519f11be64db0c9b62c77db1396b970c98748a0f0

  • SHA512

    2b8b9f33aafbdaf06a03be189e25df6696606ba0b5aa0572acec306674457c1241a2f9f85c9c314a021139a6a4a20098f3b0837af7bf77e4dd5ea57130419a95

  • SSDEEP

    393216:Tl5CKgPosKmUW/g/9887DS0+vYoYbxfQ726mDBpglmpSYuwCRks+mcjGxY6w6CgY:Tz+5UW/g/W8i5vfcGrlmbRVmvziH

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      intermec_driver.exe

    • Size

      25.2MB

    • MD5

      c3b37f6e7d7c7736ada47d6586ffb795

    • SHA1

      57c02277e11e2c445ef96dd0c6859df16d01219c

    • SHA256

      ff0414790d57b709ef8bacb519f11be64db0c9b62c77db1396b970c98748a0f0

    • SHA512

      2b8b9f33aafbdaf06a03be189e25df6696606ba0b5aa0572acec306674457c1241a2f9f85c9c314a021139a6a4a20098f3b0837af7bf77e4dd5ea57130419a95

    • SSDEEP

      393216:Tl5CKgPosKmUW/g/9887DS0+vYoYbxfQ726mDBpglmpSYuwCRks+mcjGxY6w6CgY:Tz+5UW/g/W8i5vfcGrlmbRVmvziH

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Registers COM server for autorun

      persistence

    • Registers new Print Monitor

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks