Overview

overview

7

Static

static

3

1 - Про...я.url

windows7-x64

1

1 - Про...я.url

windows10-2004-x64

1

1 - Про...й.url

windows7-x64

1

1 - Про...й.url

windows10-2004-x64

1

1 - Про...ю.url

windows7-x64

1

1 - Про...ю.url

windows10-2004-x64

1

1 - Про...ve.url

windows7-x64

1

1 - Про...ve.url

windows10-2004-x64

1

1 - Про...7z.exe

windows7-x64

1

1 - Про...7z.exe

windows10-2004-x64

1

1 - Про...tX.exe

windows7-x64

7

1 - Про...tX.exe

windows10-2004-x64

7

1 - Про...er.exe

windows7-x64

1

1 - Про...er.exe

windows10-2004-x64

1

1 - Про...�).exe

windows7-x64

1

1 - Про...�).exe

windows10-2004-x64

1

1 - Про...я.lnk

windows7-x64

3

1 - Про...я.lnk

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8decad1fdadf8aa592613772db8bb3e6710ee223fddefbcd70afc64fdd8a734

  • Size

    2.1MB

  • Sample

    231217-sa2cwaegej

  • MD5

    8991f4a974bff5d001ef02b3526345c4

  • SHA1

    9f9f34f69394b167e9ecea3f28cf2861956c42e6

  • SHA256

    c8decad1fdadf8aa592613772db8bb3e6710ee223fddefbcd70afc64fdd8a734

  • SHA512

    4e17642576720b9d7b3a5021166588289727e628c404469d49a8cad45dfec32ba90b167afb9e9b86a07db9c904f16a3f07a1061c00f55ef7d849b87ae9fd630b

  • SSDEEP

    49152:H1EU6QuDH3IkzaJM3FjoJiPdVen502nvplz5AAHNF:F5kzIM3VSsVem2nvplRL

Score
7/10
persistence

Malware Config

Targets

    • Target

      1 - Программы и Твики/10 - Отключить Фоновые Приложения.url

    • Size

      123B

    • MD5

      c11ad148171fb89dc961e943689659e9

    • SHA1

      a89fb6f3b92816967d86fb8a4401b4528ea49ab8

    • SHA256

      02a151486b595daa73b94613159f3b557b05c97235f96cf0a8c59ce7e8a6eb92

    • SHA512

      786aaede44b7148962360376bde5edd136d22936fa0fde92d745e3225a7cdfb1c8664fea4f6740da92708e198b9e2c3f97704ad961271afba01de1992a873c99

    Score
    1/10
    behavioral1behavioral2

    • Target

      1 - Программы и Твики/11 - Отключить Автозагрузку Приложений.url

    • Size

      112B

    • MD5

      3dbe9d9e68c37e7f0ef5741b36324732

    • SHA1

      e8ad9db6bc1cb382d44f9cce0038e2ac778815ac

    • SHA256

      dc1a180665b64a9cbacb15dc1fb145d6c4b566e7b668ad7fd4b6819830a6fa17

    • SHA512

      75400bf6f8f12e223437686da34afd329b6609e6886dcfb79a9b8e81cf9aca6491f712a950fa0c00ba6846bf44f1712ea23141c1eb4db10888cb73801d3799c9

    Score
    1/10
    behavioral3behavioral4

    • Target

      1 - Программы и Твики/12 - Отключить Синхронизацию.url

    • Size

      105B

    • MD5

      5120bd1982bcc6741ef0a4db17290551

    • SHA1

      712af2958555969b4f589863721fe8e57dea053a

    • SHA256

      0bbe418c4a11786d50d2f75355e1289bbe891e9451c4fac7c99386890b4de6c8

    • SHA512

      ca12c9963e2d09c264ac6de72a0f0eac9f5ebb5458d3867ccae4623e1838ef8cedd0a69221f00bdf68f61123ced9e6a2ba5db3006e8ac16b630f76469ca11672

    Score
    1/10
    behavioral5behavioral6

    • Target

      1 - Программы и Твики/13 - Удалить Skype, OneDrive.url

    • Size

      113B

    • MD5

      1636d3ead6e23281333ceaf20e2a4b22

    • SHA1

      2b5bccbe8ecc522203108f5742a7774bed231998

    • SHA256

      7f6ed8e1fa3f60c72a064b749c124250cd28a1d9d56025c563e54aee9566a53f

    • SHA512

      aa0392df6015a6d6596ecd352432eb42020fe68531ef1b9069a4161ba7a900e98ad4ac9c77a455b1f8e679996036c858a20e7425fefa77091ac4a80df7cf0852

    Score
    1/10
    behavioral7behavioral8

    • Target

      1 - Программы и Твики/2 - 7z.exe

    • Size

      1.5MB

    • MD5

      a6a0f7c173094f8dafef996157751ecf

    • SHA1

      c0dcae7c4c80be25661d22400466b4ea074fc580

    • SHA256

      b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

    • SHA512

      965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

    • SSDEEP

      24576:mGIyixBMj+/A2d+UKnvT+LwZWj7iDDVVYrz0rbzGTw3DoA/sk6smE:mGbj+/BpKnvyIxVV/XDoAfmE

    Score
    1/10
    behavioral10behavioral9

    • Target

      1 - Программы и Твики/3 - DirectX.exe

    • Size

      288KB

    • MD5

      2cbd6ad183914a0c554f0739069e77d7

    • SHA1

      7bf35f2afca666078db35ca95130beb2e3782212

    • SHA256

      2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f

    • SHA512

      ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10

    • SSDEEP

      6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0

    Score
    7/10
    persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral11behavioral12

    • Target

      1 - Программы и Твики/6 - PowerSettingsExplorer.exe

    • Size

      62KB

    • MD5

      c4d9a626b5ccdd58c0d6e2e7b878e4e3

    • SHA1

      92659bab6cb0d442b2dd5017bb016c9065b1248e

    • SHA256

      225c816d2866ad332ebb772146803d06ec59afbcc902e8439ad38b65b10dbfa5

    • SHA512

      5eb0aa0d8cc2958c692a498263c74345075aa23cd83b0032bb411fe97f458a9cbfc532dee96f2d4a86b8cacc3f44704a2cd46954ae2c209419d728bb1fc91e8d

    • SSDEEP

      768:JJjA9DzuP8rkXr+e0YMEkN3K10NoxY0vj9+MfEhl6d0TG/pW0+++Q:UZuP8nN3K10Gxhvj9+Mmrs+++Q

    Score
    1/10
    behavioral13behavioral14

    • Target

      1 - Программы и Твики/7 - Autoruns (Запуск от имени Администратора).exe

    • Size

      849KB

    • MD5

      467f8eae55485b4c763ee1c7b197b257

    • SHA1

      1ddae5b6b41641708344dc4829cc31244411ab37

    • SHA256

      76aa211322398ac0cf8f6f69ee0a5251f53ddc5a785d923abbe5bb742eeb3854

    • SHA512

      ad271cc2be5e3a32223ce9138b6943a0ee910aabdc2c84330e6ea2c56eb95cd6cef0592d4e52cc405ee6fe2d08bb5e7ed940bd52e3f5fbe24041b4c38497a33e

    • SSDEEP

      12288:moyeDBI2CaNjF3qtgUHrjk+JOlevkS5sfa5kwO8:moyABHNNjF3AgOrBJBc8w8O8

    Score
    1/10
    behavioral15behavioral16

    • Target

      1 - Программы и Твики/9 - Обновить Приложения.lnk

    • Size

      1KB

    • MD5

      59d17393d35955e7ef5f017738567bf3

    • SHA1

      83e95b1a1f45d165c5101455c4e42c8c4c1a2ac8

    • SHA256

      83aaafc9accfe6f0434be7984064383c9208bdd568724bfe010f9c52f250fd29

    • SHA512

      c1d62b730dd14e72b4ad001dc63fa5cada57fd8fb05b2691a27ca54ece0a84ef8aa9ba6bfdc8cd1062b33b18f2518a0dde5bbcb4a5e7b43452b4ed5ff33ae493

    Score
    3/10
    behavioral17behavioral18

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks