Overview

overview

10

Static

static

1

The-MALWARE-Repo

windows11-21h2-x64

Resubmissions

29-06-2024 07:53

240629-jrbzwatdqe 10

29-06-2024 07:51

240629-jpsvlswgrn 5

29-06-2024 07:48

240629-jnc3rswgqk 3

29-06-2024 07:37

240629-jf3y8atcpa 10

29-06-2024 07:36

240629-je8s3stcnd 8

29-06-2024 07:34

240629-jd4gzawfqq 1

29-06-2024 07:33

240629-jdq7mstcld 1

29-06-2024 07:29

240629-jbarwawfnj 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    The-MALWARE-Repo

  • Size

    284KB

  • Sample

    240629-jf3y8atcpa

  • MD5

    1c0a02c3390b9fd77746574def84b1d1

  • SHA1

    2e62ae7936cf5b6398308f702ddbb06427091109

  • SHA256

    29dc64e0ada4c711d0452801d3364b2f44cf4bd52337547aaa2f40744da97cd1

  • SHA512

    4f62bc5c219a6fa412dc06653227561b10cb32d144be733e0b2e57dea24baa17683dc09b84c57237326e6909e27f42ea7e1f70032eeff455d12423364bc433a2

  • SSDEEP

    6144:ibRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvZJT3CqbMrhryfQNRPaCieMjAkvCJv1VZ:qRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvC

Score
10/10
evasionexecutionpersistencetrojan

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://93.115.82.248/?0=1&1=1&2=9&3=i&4=9200&5=1&6=1111&7=nnnpgxdtai

Targets

    • Target

      The-MALWARE-Repo

    • Size

      284KB

    • MD5

      1c0a02c3390b9fd77746574def84b1d1

    • SHA1

      2e62ae7936cf5b6398308f702ddbb06427091109

    • SHA256

      29dc64e0ada4c711d0452801d3364b2f44cf4bd52337547aaa2f40744da97cd1

    • SHA512

      4f62bc5c219a6fa412dc06653227561b10cb32d144be733e0b2e57dea24baa17683dc09b84c57237326e6909e27f42ea7e1f70032eeff455d12423364bc433a2

    • SSDEEP

      6144:ibRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvZJT3CqbMrhryfQNRPaCieMjAkvCJv1VZ:qRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvC

    Score
    10/10
    evasionexecutionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Blocklisted process makes network request

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Executes dropped EXE

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks