Overview

overview

10

Static

static

1

c2d3089e50...75.exe

windows7-x64

10

c2d3089e50...75.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c2d3089e50c9f65da7c9c1bf85e71638ce37c842d5df7e40ddf1df9e94494775.exe
  • Size 9.1MB
  • Sample240821-ffn9aa1apd
  • SHA256 c2d3089e50c9f65da7c9c1bf85e71638ce37c842d5df7e40ddf1df9e94494775
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasiondiscoveryevasionexecution

Malware Config

Targets

    • Target
      c2d3089e50c9f65da7c9c1bf85e71638ce37c842d5df7e40ddf1df9e94494775.exe
    • Size 9.1MB
    • SHA256 c2d3089e50c9f65da7c9c1bf85e71638ce37c842d5df7e40ddf1df9e94494775
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionexecutiondefense_evasion

    • Modifies security service

      evasion

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Executes dropped EXE

    • Indicator Removal: Clear Windows Event Logs

      Clear Windows Event Logs to hide the activity of an intrusion.

      defense_evasion

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks