Overview

overview

10

Static

static

3

cd92a293cb...51.exe

windows7-x64

10

cd92a293cb...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451

  • Size

    120KB

  • Sample

    240524-dzywqabd82

  • MD5

    89e6e948d69c3bb0ec0e3711cae65952

  • SHA1

    ddeaa13e7d941447a9debb4b8e5f040778d92b15

  • SHA256

    cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451

  • SHA512

    3c8ab0366c59c2b4904b45e857b14232ac0855b2864bccf2cfbc1cbfbab53d5957e8c401fae0b391159ab36ed09e03d8ec431f19530f377f71c5ac0bf71e2d38

  • SSDEEP

    3072:xGpbUpd1/l0izZF6yCenK2iGlefx8X1/:xGp+1pzZF44K3AAKX1

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451

    • Size

      120KB

    • MD5

      89e6e948d69c3bb0ec0e3711cae65952

    • SHA1

      ddeaa13e7d941447a9debb4b8e5f040778d92b15

    • SHA256

      cd92a293cbae54cbbf646d747d70905cc9e4d60dc42ee40d3044c138012df451

    • SHA512

      3c8ab0366c59c2b4904b45e857b14232ac0855b2864bccf2cfbc1cbfbab53d5957e8c401fae0b391159ab36ed09e03d8ec431f19530f377f71c5ac0bf71e2d38

    • SSDEEP

      3072:xGpbUpd1/l0izZF6yCenK2iGlefx8X1/:xGp+1pzZF44K3AAKX1

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks