Overview

overview

10

Static

static

10

53fff9337c...92.exe

windows10-1703-x64

8

Resubmissions

24-06-2023 18:32

230624-w6wdaaca62 10

24-06-2023 18:23

230624-w1la5adb3t 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53fff9337c461ac70fd7cf955e28ed5491d510c8c0751ffc5399a9afe5fb1c92

  • Size

    3.9MB

  • Sample

    230624-w6wdaaca62

  • MD5

    0f960403760090619b597c4ffd500b66

  • SHA1

    7b3fcd7f5e759d0cfb81ac6b8a4061e49a63596f

  • SHA256

    53fff9337c461ac70fd7cf955e28ed5491d510c8c0751ffc5399a9afe5fb1c92

  • SHA512

    bdb2be2d0cbbd8d25e0041fd3f931b06bceb1f9801328d3f4c48a368517684c2d366925564bb1a8365b0677c8ffc55660a37d6816dddf735c0509bb0e6923d82

  • SSDEEP

    49152:eC/pVUOajTbpPHiHvVEgHztu+thX44ifGJtSqeQLgza6BDm5TN+IMUu9+d1cL+N:xBuh18VzArOSqeDalc6dF

Score
10/10
blackmoonmicrosoftpersistencephishing

Malware Config

Targets

    • Target

      53fff9337c461ac70fd7cf955e28ed5491d510c8c0751ffc5399a9afe5fb1c92

    • Size

      3.9MB

    • MD5

      0f960403760090619b597c4ffd500b66

    • SHA1

      7b3fcd7f5e759d0cfb81ac6b8a4061e49a63596f

    • SHA256

      53fff9337c461ac70fd7cf955e28ed5491d510c8c0751ffc5399a9afe5fb1c92

    • SHA512

      bdb2be2d0cbbd8d25e0041fd3f931b06bceb1f9801328d3f4c48a368517684c2d366925564bb1a8365b0677c8ffc55660a37d6816dddf735c0509bb0e6923d82

    • SSDEEP

      49152:eC/pVUOajTbpPHiHvVEgHztu+thX44ifGJtSqeQLgza6BDm5TN+IMUu9+d1cL+N:xBuh18VzArOSqeDalc6dF

    Score
    8/10
    microsoftpersistencephishing

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks