Overview

overview

10

Static

static

5

45b5f66f35...e5.exe

windows7-x64

1

45b5f66f35...e5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    45b5f66f35a83b37e94c3c6e634938e5

  • Size

    512KB

  • Sample

    240106-jy1ltacga2

  • MD5

    45b5f66f35a83b37e94c3c6e634938e5

  • SHA1

    e53a167d1bd7f8ff5496b6d637c7de712ab20bed

  • SHA256

    d97e4e4578b009a7c9c30b05773877f833fd4557f844cf68e2b2e177c8a2c07d

  • SHA512

    6806d8b80b450d195c6e21a65e88f68670a5010e15fdaa035434bf250ee1f60da6e7189cea85fd58787a8a6128f537d243c2a787fdc912eeaee06fb3f6a7a143

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      45b5f66f35a83b37e94c3c6e634938e5

    • Size

      512KB

    • MD5

      45b5f66f35a83b37e94c3c6e634938e5

    • SHA1

      e53a167d1bd7f8ff5496b6d637c7de712ab20bed

    • SHA256

      d97e4e4578b009a7c9c30b05773877f833fd4557f844cf68e2b2e177c8a2c07d

    • SHA512

      6806d8b80b450d195c6e21a65e88f68670a5010e15fdaa035434bf250ee1f60da6e7189cea85fd58787a8a6128f537d243c2a787fdc912eeaee06fb3f6a7a143

    • SSDEEP

      6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55

    Score
    10/10
    evasionpersistencetrojan

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks