Overview

overview

8

Static

static

3

test.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test.exe

  • Size

    14.5MB

  • Sample

    240420-eac4dsgc9t

  • MD5

    78440e8d718c070d224e4a2b4fa95087

  • SHA1

    78de3ba2ce4798ce49bc47647420044e6ab28c29

  • SHA256

    41af58fbe9eb08bebab0692fccfe1d4a35e267ba4e6971272c6c0f7cb8115c86

  • SHA512

    3b7c9db43de996cf12dff9ab3ca68daa970a74222d66e5de19d48e1f19f8d19a3680227004ea5b00c89f1fd30abc960dc3617db5f3d6135531ad899cbb50154a

  • SSDEEP

    393216:T9KlooW1yjk++JZdbgGITEkBK4uaO7Zp1aL/Wr6b:TMlzkBfSDEkPuR+WrW

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      test.exe

    • Size

      14.5MB

    • MD5

      78440e8d718c070d224e4a2b4fa95087

    • SHA1

      78de3ba2ce4798ce49bc47647420044e6ab28c29

    • SHA256

      41af58fbe9eb08bebab0692fccfe1d4a35e267ba4e6971272c6c0f7cb8115c86

    • SHA512

      3b7c9db43de996cf12dff9ab3ca68daa970a74222d66e5de19d48e1f19f8d19a3680227004ea5b00c89f1fd30abc960dc3617db5f3d6135531ad899cbb50154a

    • SSDEEP

      393216:T9KlooW1yjk++JZdbgGITEkBK4uaO7Zp1aL/Wr6b:TMlzkBfSDEkPuR+WrW

    Score
    8/10
    discoverypersistence

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks