Overview

overview

10

Static

static

3

SecuriteIn...52.exe

windows7-x64

10

SecuriteIn...52.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win64.PWSX-gen.17352.24153

  • Size

    739KB

  • Sample

    240501-twlpzsba8x

  • MD5

    120f43da8f3b2b7f24d2b509d197a885

  • SHA1

    bb27a97f1c6e012b470e5035821bdad604037267

  • SHA256

    ebe535e02ec19a129be4434bfa18f1fceed895db2befd06ec711594f44481990

  • SHA512

    66bc3a9c4b4e115bbd9df2f6b0c8eef539e0cb2bc36042785dacbb24b0dccd6b66c00e647a71e8c8a9e5c2913b17f1527b689afb77a305d48164745f74457f7b

  • SSDEEP

    12288:c5lgDBfevt7xVz/0yM5XxNfLG4KDGEoZ/ifs76cFaaxS3/KTX9xnOEp:eKDBfevlfz/0yMrNfa4WLVcw2S3sTTp

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win64.PWSX-gen.17352.24153

    • Size

      739KB

    • MD5

      120f43da8f3b2b7f24d2b509d197a885

    • SHA1

      bb27a97f1c6e012b470e5035821bdad604037267

    • SHA256

      ebe535e02ec19a129be4434bfa18f1fceed895db2befd06ec711594f44481990

    • SHA512

      66bc3a9c4b4e115bbd9df2f6b0c8eef539e0cb2bc36042785dacbb24b0dccd6b66c00e647a71e8c8a9e5c2913b17f1527b689afb77a305d48164745f74457f7b

    • SSDEEP

      12288:c5lgDBfevt7xVz/0yM5XxNfLG4KDGEoZ/ifs76cFaaxS3/KTX9xnOEp:eKDBfevlfz/0yMrNfa4WLVcw2S3sTTp

    Score
    10/10
    evasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks