Overview

overview

10

Static

static

3

a29c4a25aa...f9.exe

windows7-x64

10

a29c4a25aa...f9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a29c4a25aa48b4de7a5b0bab9ca84c2030cc109150edf8e1a3eacd599fdccdf9

  • Size

    479KB

  • Sample

    240604-bdfrxaff3w

  • MD5

    2bc1d12aaf364f764ab8a9d5707ed33a

  • SHA1

    bbd3492a547073cc98715c116f9b3fc9fa7ab907

  • SHA256

    a29c4a25aa48b4de7a5b0bab9ca84c2030cc109150edf8e1a3eacd599fdccdf9

  • SHA512

    19f6046cab762800acff20b6eb2477884a9c9a9e00c02cdc65ec2a818760f797443445322d27b047122cb54a841ab892a73767c9626bc073a9884ae51a7bfff1

  • SSDEEP

    6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnW3:nRDc3yWDNU+YUznzNjElWaT07NQtDW3

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      a29c4a25aa48b4de7a5b0bab9ca84c2030cc109150edf8e1a3eacd599fdccdf9

    • Size

      479KB

    • MD5

      2bc1d12aaf364f764ab8a9d5707ed33a

    • SHA1

      bbd3492a547073cc98715c116f9b3fc9fa7ab907

    • SHA256

      a29c4a25aa48b4de7a5b0bab9ca84c2030cc109150edf8e1a3eacd599fdccdf9

    • SHA512

      19f6046cab762800acff20b6eb2477884a9c9a9e00c02cdc65ec2a818760f797443445322d27b047122cb54a841ab892a73767c9626bc073a9884ae51a7bfff1

    • SSDEEP

      6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnW3:nRDc3yWDNU+YUznzNjElWaT07NQtDW3

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Sets service image path in registry

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks