Overview

overview

8

Static

static

1

POI31205.exe

windows7-x64

8

POI31205.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    POI31205.exe

  • Size

    766KB

  • Sample

    240617-jsszsa1eke

  • MD5

    2e4aca518794b0e8db91ff9554732535

  • SHA1

    6b63f1c75bc0e92ec9613860d2d035155437e545

  • SHA256

    89b63065bdccd198ddf4306967690c01b658b62b15a3b002399266160fd8223d

  • SHA512

    3fa06926f6f8ed3ca80eb79408160484c6e27cf78929d1a0bfe938b11030b941959d019c4d18d84cf3a1a83b95d2842d1b91a697f6069a3f07fb450067af7d17

  • SSDEEP

    12288:TFRwba0Ugzh4BIUQOmqmjamjv6tJ04W1Wc+pfbOqX81N/3sU971Zq7RH0d3c:AOLgrUQOfmZcJeWc+pz/sH/zvZqFws

Score
8/10
executionpersistence

Malware Config

Targets

    • Target

      POI31205.exe

    • Size

      766KB

    • MD5

      2e4aca518794b0e8db91ff9554732535

    • SHA1

      6b63f1c75bc0e92ec9613860d2d035155437e545

    • SHA256

      89b63065bdccd198ddf4306967690c01b658b62b15a3b002399266160fd8223d

    • SHA512

      3fa06926f6f8ed3ca80eb79408160484c6e27cf78929d1a0bfe938b11030b941959d019c4d18d84cf3a1a83b95d2842d1b91a697f6069a3f07fb450067af7d17

    • SSDEEP

      12288:TFRwba0Ugzh4BIUQOmqmjamjv6tJ04W1Wc+pfbOqX81N/3sU971Zq7RH0d3c:AOLgrUQOfmZcJeWc+pz/sH/zvZqFws

    Score
    8/10
    executionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks