Overview

overview

8

Static

static

1

windirstat...up.exe

windows7-x64

8

windirstat...up.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    windirstat1_1_2_setup.exe

  • Size

    630KB

  • Sample

    230116-aj9fqsec58

  • MD5

    3abf1c149873e25d4e266225fbf37cbf

  • SHA1

    6fa92dd2ca691c11dfbfc0a239e34369897a7fab

  • SHA256

    370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd

  • SHA512

    b6d9672a580a02299bc370deb1fd99b5ca10ab86456385870cdae522c185ae51f8d390a7c50fcb5c7898523f52c834bb73515ffc6d0b0bcde210640e815ece9e

  • SSDEEP

    12288:yCjeMsiGVBKvjxTNlZaLlcMj+wXZvQpd9nP2+ZMU2tYspZcMwr/GNd35:yCjeTZa7BTsxewXZUTP2HU2yawjY5

Score
8/10
discoveryspywarestealer

Malware Config

Targets

    • Target

      windirstat1_1_2_setup.exe

    • Size

      630KB

    • MD5

      3abf1c149873e25d4e266225fbf37cbf

    • SHA1

      6fa92dd2ca691c11dfbfc0a239e34369897a7fab

    • SHA256

      370a27a30ee57247faddeb1f99a83933247e07c8760a07ed82e451e1cb5e5cdd

    • SHA512

      b6d9672a580a02299bc370deb1fd99b5ca10ab86456385870cdae522c185ae51f8d390a7c50fcb5c7898523f52c834bb73515ffc6d0b0bcde210640e815ece9e

    • SSDEEP

      12288:yCjeMsiGVBKvjxTNlZaLlcMj+wXZvQpd9nP2+ZMU2tYspZcMwr/GNd35:yCjeTZa7BTsxewXZUTP2HU2yawjY5

    Score
    8/10
    discoveryspywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks