Overview

overview

8

Static

static

1

windowsdes...86.exe

windows7-x64

windowsdes...86.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    windowsdesktop-runtime-3.1.32-win-x86.exe

  • Size

    46.8MB

  • Sample

    230412-bt2djsgf77

  • MD5

    64820bb359e69b81ea680eeb24ca4c22

  • SHA1

    8f0c04ecf97aae2d68354bddf4d1599a6dbc97e9

  • SHA256

    765436d4aa3de87af8b390d1cd16fce94c5f72dd04173adbb49c940b98b47704

  • SHA512

    6b96d2db0d42d06683b6fc2e991193686167d40c85912737705db23dbe8dc7d6b80689ab25201fc0a397c70c463c3fdd40d294e9c47d48b375ff8b7a0a699cf7

  • SSDEEP

    786432:C+ajAAOzYCmKU8agc0eCQHP06ymAPMwNYnp8zHITMp0s5IcmWTNK5TxlOsDsCpxf:IjTOFVU8agcjZHBxAPQp+H2Mp2cmq4XP

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      windowsdesktop-runtime-3.1.32-win-x86.exe

    • Size

      46.8MB

    • MD5

      64820bb359e69b81ea680eeb24ca4c22

    • SHA1

      8f0c04ecf97aae2d68354bddf4d1599a6dbc97e9

    • SHA256

      765436d4aa3de87af8b390d1cd16fce94c5f72dd04173adbb49c940b98b47704

    • SHA512

      6b96d2db0d42d06683b6fc2e991193686167d40c85912737705db23dbe8dc7d6b80689ab25201fc0a397c70c463c3fdd40d294e9c47d48b375ff8b7a0a699cf7

    • SSDEEP

      786432:C+ajAAOzYCmKU8agc0eCQHP06ymAPMwNYnp8zHITMp0s5IcmWTNK5TxlOsDsCpxf:IjTOFVU8agcjZHBxAPQp+H2Mp2cmq4XP

    Score
    8/10
    discoverypersistence

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks