Overview

overview

10

Static

static

1

aaaaa.exe

windows7-x64

10

aaaaa.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    aaaaa.zip

  • Size

    7.0MB

  • Sample

    231013-zm2mqsbg62

  • MD5

    8a545e2da0c005f9221811b5fbe4191a

  • SHA1

    08fcac02e6a59696b9ef84227c223cc608c99098

  • SHA256

    8c658f7d9116f94eb8acacb9fba1387db5fafeac4fca9989f0b6f1e788682ec4

  • SHA512

    67d070079b8a0f7e1a7de2e0cefbd2aade94184a6a4449207b99c4125795cf8f93d83f3f460906b2d9fa98db623c688bb92348edc327f1c5d8b6f8931a623cdf

  • SSDEEP

    196608:VgThgUVgEoqQgRWEkAWM+KMcFdDaUDu/+2RFyw3Jk3FalIWEW6C2odod:VAyUyEoQE5A/dMONan+2RFQ8IpJCQd

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      aaaaa.exe

    • Size

      9.9MB

    • MD5

      b2ccd53c26ce8e8212fd7493d431b102

    • SHA1

      042c94da0059970723b62f25f3b747771a80cc8e

    • SHA256

      1b877e83645bbb6acd36e14ed8289bcd11d627a6cb57a3404151833b478cb82d

    • SHA512

      01feb8e1eb171ad3ffd9f03ee436f4590ba4e52513cbb597d65850d6b0ed9d19535bdbba9abda3473bbbecb5f32e955079e4287e2d51a21984c50e7d8bd81005

    • SSDEEP

      98304:BJAV/FheVj7HFjIcWxfrUn7llE0Cghlz3yKV7RsQzR8b4XqjsTTeaoV84HlEqaIh:B1HF8chpKiVrH64neL9HKqaJl2

    Score
    10/10
    evasionpersistence

    • Modifies security service

      evasion

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Sets service image path in registry

      persistence

    • Stops running service(s)

      evasion

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks