Overview

overview

10

Static

static

1

PROD_Start...ck.hta

windows7-x64

10

PROD_Start...ck.hta

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PROD_Start_DriverPack.hta

  • Size

    1KB

  • Sample

    240921-akcs6awejl

  • MD5

    dda846a4704efc2a03e1f8392e6f1ffc

  • SHA1

    387171a06eee5a76aaedc3664385bb89703cf6df

  • SHA256

    e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25

  • SHA512

    5cc5ad3fbdf083a87a65be76869bca844faa2d9be25657b45ad070531892f20d9337739590dd8995bca03ce23e9cb611129fe2f8457879b6263825d6df49da7a

Score
10/10
defense_evasiondiscoverydropperevasionpersistenceprivilege_escalationupx

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://dwrapper-prod.herokuapp.com/bin/watcher.html

Targets

    • Target

      PROD_Start_DriverPack.hta

    • Size

      1KB

    • MD5

      dda846a4704efc2a03e1f8392e6f1ffc

    • SHA1

      387171a06eee5a76aaedc3664385bb89703cf6df

    • SHA256

      e9dc9648d8fb7d943431459f49a7d9926197c2d60b3c2b6a58294fd75b672b25

    • SHA512

      5cc5ad3fbdf083a87a65be76869bca844faa2d9be25657b45ad070531892f20d9337739590dd8995bca03ce23e9cb611129fe2f8457879b6263825d6df49da7a

    Score
    10/10
    defense_evasiondiscoverydropperevasionpersistenceprivilege_escalationupx

    • Blocklisted process makes network request

    • Download via BitsAdmin

      dropper

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

1
T1197

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

BITS Jobs

1
T1197

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks