Resubmissions

22-05-2024 09:47

240522-lses9sba38 4

22-05-2024 09:35

240522-lketasah4t 10

General

  • Target

    dugga_848274.seb

  • Size

    5KB

  • Sample

    240522-lketasah4t

  • MD5

    7867d29c88ed216103feb5021f01ebf8

  • SHA1

    543af5ce7d60b6bf66d44d6bc42515d7fc97e796

  • SHA256

    43adf87d5486202112a4bdea368abc46b5fb6f2ae2a6083b8a87e18723b2feee

  • SHA512

    f0a22affd6b56154e0ad15a28fadedbc1977fc1fe72b6280d3d87c72ad8d7df1b3a465d9532869a30c09e88cd35ab0f0f6ed188513a38a5ae090d575797354a9

  • SSDEEP

    96:xUS0wqaXc0hWp9nVRcerCWZIIvj2y/dT2/7HpPotQWtfDmDa:xUncc79VierCW7vj9/Q/7pKQULf

Malware Config

Targets

    • Target

      dugga_848274.seb

    • Size

      5KB

    • MD5

      7867d29c88ed216103feb5021f01ebf8

    • SHA1

      543af5ce7d60b6bf66d44d6bc42515d7fc97e796

    • SHA256

      43adf87d5486202112a4bdea368abc46b5fb6f2ae2a6083b8a87e18723b2feee

    • SHA512

      f0a22affd6b56154e0ad15a28fadedbc1977fc1fe72b6280d3d87c72ad8d7df1b3a465d9532869a30c09e88cd35ab0f0f6ed188513a38a5ae090d575797354a9

    • SSDEEP

      96:xUS0wqaXc0hWp9nVRcerCWZIIvj2y/dT2/7HpPotQWtfDmDa:xUncc79VierCW7vj9/Q/7pKQULf

    • UAC bypass

    • Downloads MZ/PE file

    • Possible privilege escalation attempt

    • Executes dropped EXE

    • Modifies file permissions

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • Target

      sample

    • Size

      5KB

    • MD5

      c31020e4835be00569e290ee53515a93

    • SHA1

      9ff7b0031069f6371cf7ed8b53659873df3eee5a

    • SHA256

      629328afa29bb1b0abd0b3d5bc3fa71d232f8db3f639e4fbed78193306a1d665

    • SHA512

      d79054ad1d7b168ad594018cd4afbbb23191210c563556404d0769d05dc5d2d3c21edd271fd20d026fa2357e9770b2c52c53ae3d7b0aa753c3d95f295a55c7bd

    • SSDEEP

      96:TUS0wqaXc0hWp9nVRcerCWZIIvj2y/dT2/7HpPotQWtfDmDt:TUncc79VierCW7vj9/Q/7pKQULY

    Score
    1/10

MITRE ATT&CK Matrix ATT&CK v13

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

File and Directory Permissions Modification

1
T1222

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Discovery

System Information Discovery

6
T1082

Query Registry

5
T1012

Peripheral Device Discovery

2
T1120

Command and Control

Web Service

1
T1102

Tasks