Overview

overview

10

Static

static

1

0x00020000...37.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0x0002000000022ea7-1237

  • Size

    327KB

  • Sample

    240711-wmeanazfnh

  • MD5

    22b25918bfdd12b1b6646cf6cdf1e867

  • SHA1

    3b621a13ff4b1493df48992d37fcc9d67edf40ab

  • SHA256

    8be6deb199d15344938cca068b14d9af482d69b0e864c42bc0f11690dd8cf1f7

  • SHA512

    32fbbb221a7aa0977d07c4ad67c3564f133cdade6db8488e67345ecf5c8d594123da1ddb506166f1e25ce6174a004f3f5d428dfea44eda4b7ce4a24cd33721e2

  • SSDEEP

    6144:seIJOgbSk6haa3G7YWoWTAqkUgE0YRa8ts:shOgShtusWsvE7e

Score
10/10
defense_evasionpersistence

Malware Config

Targets

    • Target

      0x0002000000022ea7-1237

    • Size

      327KB

    • MD5

      22b25918bfdd12b1b6646cf6cdf1e867

    • SHA1

      3b621a13ff4b1493df48992d37fcc9d67edf40ab

    • SHA256

      8be6deb199d15344938cca068b14d9af482d69b0e864c42bc0f11690dd8cf1f7

    • SHA512

      32fbbb221a7aa0977d07c4ad67c3564f133cdade6db8488e67345ecf5c8d594123da1ddb506166f1e25ce6174a004f3f5d428dfea44eda4b7ce4a24cd33721e2

    • SSDEEP

      6144:seIJOgbSk6haa3G7YWoWTAqkUgE0YRa8ts:shOgShtusWsvE7e

    Score
    10/10
    defense_evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks