Overview

overview

10

Static

static

10

819f6d9abf...ca.exe

windows7-x64

10

819f6d9abf...ca.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    819f6d9abf3f55e2d5026e0eac2cdaa2fd8d91ac80d359cdb969bbc515bb54ca

  • Size

    91KB

  • Sample

    240522-ckdfssgh77

  • MD5

    7cc3ebfb126590fe4dfd67558a765ee3

  • SHA1

    47d89c5aac13ef061c9225611e026a9322c64806

  • SHA256

    819f6d9abf3f55e2d5026e0eac2cdaa2fd8d91ac80d359cdb969bbc515bb54ca

  • SHA512

    fdc939ccfd37e5d72a468b6c5d307f51909816efb5843f4cde442e4c12e5cc6df0ab14fa324ad7775d7b18b1b2322b896c6b2e2ade0ad9d8234f261fd7b6aa08

  • SSDEEP

    1536:zAwEmBZ04faWmtN4nic+6Gw3AwEmBZ04faWmtN4nic+6GoV:zGms4Eton0w3Gms4Eton0oV

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      819f6d9abf3f55e2d5026e0eac2cdaa2fd8d91ac80d359cdb969bbc515bb54ca

    • Size

      91KB

    • MD5

      7cc3ebfb126590fe4dfd67558a765ee3

    • SHA1

      47d89c5aac13ef061c9225611e026a9322c64806

    • SHA256

      819f6d9abf3f55e2d5026e0eac2cdaa2fd8d91ac80d359cdb969bbc515bb54ca

    • SHA512

      fdc939ccfd37e5d72a468b6c5d307f51909816efb5843f4cde442e4c12e5cc6df0ab14fa324ad7775d7b18b1b2322b896c6b2e2ade0ad9d8234f261fd7b6aa08

    • SSDEEP

      1536:zAwEmBZ04faWmtN4nic+6Gw3AwEmBZ04faWmtN4nic+6GoV:zGms4Eton0w3Gms4Eton0oV

    Score
    10/10
    evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Detects executables built or packed with MPress PE compressor

    • Disables RegEdit via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

6
T1112

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Resource Development

Reconnaissance

Tasks