Overview

overview

8

Static

static

1

crcook (4).txt

windows10-1703-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    crcook (4).txt

  • Size

    116KB

  • Sample

    231223-lmbjnaefgr

  • MD5

    da309289618ed1608d7c22f058357267

  • SHA1

    16620dbee47cd39c8eb8e6b87ac474527c14a84b

  • SHA256

    acf5894f57cd8f02dc00474954c26153cb9368d053c783b1a1cc04eca19b8f07

  • SHA512

    334589ccc6c9bcd82f5f5d562d2ab58795c61ccd5b692fd0c476bf96e06bf26210672e95cfb152a7ee87e87be1b36832f30eb17b7556e70de5207c8f1062e7bd

  • SSDEEP

    1536:Q+ltl92zdJcn2Z91fjvq2HX+QiP0ebXj+FXXyV:QsXmJPjvq+OFP0+j0XXyV

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      crcook (4).txt

    • Size

      116KB

    • MD5

      da309289618ed1608d7c22f058357267

    • SHA1

      16620dbee47cd39c8eb8e6b87ac474527c14a84b

    • SHA256

      acf5894f57cd8f02dc00474954c26153cb9368d053c783b1a1cc04eca19b8f07

    • SHA512

      334589ccc6c9bcd82f5f5d562d2ab58795c61ccd5b692fd0c476bf96e06bf26210672e95cfb152a7ee87e87be1b36832f30eb17b7556e70de5207c8f1062e7bd

    • SSDEEP

      1536:Q+ltl92zdJcn2Z91fjvq2HX+QiP0ebXj+FXXyV:QsXmJPjvq+OFP0+j0XXyV

    Score
    8/10
    discoverypersistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks