Overview

overview

9

Static

static

3

IIMG_00172424.exe

windows7-x64

8

IIMG_00172424.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IIMG_00172424.exe

  • Size

    716KB

  • Sample

    240724-hr38patcql

  • MD5

    12357dcb00ad3f1bf0775ff13cf0084d

  • SHA1

    28d9a79a4e18c87f4e76daa8da996e755cbf7850

  • SHA256

    7ed9a3c3e7a0edc6a81e2b326832a8d3a27a192131861cbfc616d87e6eff642a

  • SHA512

    cd26cba1a32f4b0a9dc15baf6eee7c5d2a3943e8a7f65bbd5e6dc69747bf3edaef38af6aa2be832939a9bd16b762e0dc8ad85e3ee707fc311e5cad8c7c473126

  • SSDEEP

    12288:GuCSY+aZrwra6Cgrdm8Kyjlp3432YCdMi2s/PlEkJQ40bPscBy5z43yFJ0tlYB:4/4ra6CIm8KqfzIe3JQ40TtBqkCFJ0t

Score
9/10
credential_accessdiscoveryexecutionpersistenceprivilege_escalationstealer

Malware Config

Targets

    • Target

      IIMG_00172424.exe

    • Size

      716KB

    • MD5

      12357dcb00ad3f1bf0775ff13cf0084d

    • SHA1

      28d9a79a4e18c87f4e76daa8da996e755cbf7850

    • SHA256

      7ed9a3c3e7a0edc6a81e2b326832a8d3a27a192131861cbfc616d87e6eff642a

    • SHA512

      cd26cba1a32f4b0a9dc15baf6eee7c5d2a3943e8a7f65bbd5e6dc69747bf3edaef38af6aa2be832939a9bd16b762e0dc8ad85e3ee707fc311e5cad8c7c473126

    • SSDEEP

      12288:GuCSY+aZrwra6Cgrdm8Kyjlp3432YCdMi2s/PlEkJQ40bPscBy5z43yFJ0tlYB:4/4ra6CIm8KqfzIe3JQ40TtBqkCFJ0t

    Score
    9/10
    discoveryexecutionpersistenceprivilege_escalationcredential_accessstealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Scripting

1
T1064

Persistence

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Scripting

1
T1064

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks