Overview

overview

10

Static

static

3

9650e00ef3...7c.exe

windows7-x64

10

9650e00ef3...7c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9650e00ef30bc7abe8becec63619e47c

  • Size

    516KB

  • Sample

    240212-fpy5vaed32

  • MD5

    9650e00ef30bc7abe8becec63619e47c

  • SHA1

    295a2a3b936f4d59134f0f9a1869220784de8a66

  • SHA256

    93b16aa9542c8f7cc4b6cf48ce2f51cb3b97b71f055792d21209854cefb87d1a

  • SHA512

    cbb68eca8094820f85242284663023f0bbc54d18a60c5f9eacae0db9ab32166e3b23c052b6861bc059ebd819b195af91a84f49cbeb48163083b1a3e5d2d43ff3

  • SSDEEP

    12288:IDOCHBIeaaSjCSwtqg3lgvGJCSWMiHaWvwLU4U9xjZ:IMj0Wl+8VMiLr

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      9650e00ef30bc7abe8becec63619e47c

    • Size

      516KB

    • MD5

      9650e00ef30bc7abe8becec63619e47c

    • SHA1

      295a2a3b936f4d59134f0f9a1869220784de8a66

    • SHA256

      93b16aa9542c8f7cc4b6cf48ce2f51cb3b97b71f055792d21209854cefb87d1a

    • SHA512

      cbb68eca8094820f85242284663023f0bbc54d18a60c5f9eacae0db9ab32166e3b23c052b6861bc059ebd819b195af91a84f49cbeb48163083b1a3e5d2d43ff3

    • SSDEEP

      12288:IDOCHBIeaaSjCSwtqg3lgvGJCSWMiHaWvwLU4U9xjZ:IMj0Wl+8VMiLr

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks