Overview

overview

8

Static

static

1

Ordine_doc...04.bat

windows7-x64

8

Ordine_doc...04.bat

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    9c63f1e925f64d39757624dfd3cf8654338a46de269678dae3ccb72d1c04f532.iso

  • Size

    64KB

  • Sample

    240420-b3teasdb34

  • MD5

    fbf7ef71e00b28373ef9d495142fd182

  • SHA1

    8039fd980040ae83cee314505f41bc7c678c5771

  • SHA256

    9c63f1e925f64d39757624dfd3cf8654338a46de269678dae3ccb72d1c04f532

  • SHA512

    75dda15d11f3aa994a4aba221c561feef7bb229b7387295d390d282f75ed92e407be5e3533e658d2cc4258896163d92d26aa868cb3599566b7476202a97ed489

  • SSDEEP

    48:50jj4+7LgjYvTag6l2FFJKqwsqQlpj70NUQ4f6MiIHEDOgnqZmnrANQ:50X7MqTdtJXNpv0NUQEjoOgHnrANQ

Score
8/10
persistence

Malware Config

Targets

    • Target

      Ordine_doc_419024001904.bat

    • Size

      2KB

    • MD5

      fc2d2d71c178fe702dac6ef8f4ab3e03

    • SHA1

      b2f0157962e4d04966a6348836a07db25dad4833

    • SHA256

      3d252afaaec1a738e31fe9138e502fcd31a32f388cc55f9aca003ecad30e97b4

    • SHA512

      64cf326e489705acb10afea69af45c6c7159ed19e29878e5911ffc58c7fb6aeda3c1f3adbb67dc04d56e3817352bbb430d6bda50fd10d67650cfc0d8496002fd

    Score
    8/10
    persistence

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks