Overview

overview

10

Static

static

3

cd9836548a...1d.exe

windows7-x64

10

cd9836548a...1d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd9836548a80952bb29b791e7240571292bc43903891a4f0c40e6b3a93afc41d

  • Size

    480KB

  • Sample

    240429-cvpltafg9t

  • MD5

    80b3213c4737cbd603c23d360d007776

  • SHA1

    8e15b0c5f473eaa88e8d2e730f078e75681a7ac6

  • SHA256

    cd9836548a80952bb29b791e7240571292bc43903891a4f0c40e6b3a93afc41d

  • SHA512

    4f48bd9869075d290d78d928e7b4747de6e4002e4a8bad9ee016f3e94a3a756885c4f675531ab18d1d010cab214d9b05c3978a9b0075648db0a2f7439e8a0ba1

  • SSDEEP

    6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnE:nRDc3yWDNU+YUznzNjElWaT07NQtDE

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      cd9836548a80952bb29b791e7240571292bc43903891a4f0c40e6b3a93afc41d

    • Size

      480KB

    • MD5

      80b3213c4737cbd603c23d360d007776

    • SHA1

      8e15b0c5f473eaa88e8d2e730f078e75681a7ac6

    • SHA256

      cd9836548a80952bb29b791e7240571292bc43903891a4f0c40e6b3a93afc41d

    • SHA512

      4f48bd9869075d290d78d928e7b4747de6e4002e4a8bad9ee016f3e94a3a756885c4f675531ab18d1d010cab214d9b05c3978a9b0075648db0a2f7439e8a0ba1

    • SSDEEP

      6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnE:nRDc3yWDNU+YUznzNjElWaT07NQtDE

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Sets service image path in registry

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks