Overview

overview

10

Static

static

1

message (5).txt

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    message (5).txt

  • Size

    5KB

  • Sample

    240512-p5kf3aff4y

  • MD5

    7cfc3906c2a6281f710f67824a009239

  • SHA1

    fde3fba3a99492c4f74d2961de3184807d22da1b

  • SHA256

    4a6305223da99ad01d47aa20b3d8bc9b2b33c68ca818a54c2d82ff3d20ce72c7

  • SHA512

    b3af972aaad1e8a381db0efb941a1e5db8116106aabf3598dcf79c98ecf0cd5378d87a3d6f42119248f7dc332769c685f69b7e66117d8eaddcc13d9c155526ba

  • SSDEEP

    96:2Wf6ZGxPyGGCgbGIRnqRQspRPwTQxyQy8Q0UWQceYcQgQxQnQviDQEbZNX5R2BYW:2Wf6ZGxPyGGCgbGIRnqRQspRaVf8/bcQ

Score
10/10
discoveryevasionexploitpersistencetrojan

Malware Config

Targets

    • Target

      message (5).txt

    • Size

      5KB

    • MD5

      7cfc3906c2a6281f710f67824a009239

    • SHA1

      fde3fba3a99492c4f74d2961de3184807d22da1b

    • SHA256

      4a6305223da99ad01d47aa20b3d8bc9b2b33c68ca818a54c2d82ff3d20ce72c7

    • SHA512

      b3af972aaad1e8a381db0efb941a1e5db8116106aabf3598dcf79c98ecf0cd5378d87a3d6f42119248f7dc332769c685f69b7e66117d8eaddcc13d9c155526ba

    • SSDEEP

      96:2Wf6ZGxPyGGCgbGIRnqRQspRPwTQxyQy8Q0UWQceYcQgQxQnQviDQEbZNX5R2BYW:2Wf6ZGxPyGGCgbGIRnqRQspRaVf8/bcQ

    Score
    10/10
    discoveryevasionexploitpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies AppInit DLL entries

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Possible privilege escalation attempt

      exploit

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

File and Directory Permissions Modification

1
T1222

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

8
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks