Overview

overview

10

Static

static

3

setup-w8.1-1.4.6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup-w8.1-1.4.6.exe

  • Size

    2.1MB

  • Sample

    241015-brx84swglb

  • MD5

    938548152c35c028b942b33088d0f3b9

  • SHA1

    6ead124c740dfddc2ab09f1739df760c6d1ee7d3

  • SHA256

    108a8be5260047a10d49105e7f5c22f949bae4e866278b169b66358ea43145ff

  • SHA512

    004bd6ca1e1dbbbe258fe42dcb628607e4a178f09bc40637a9660568953be883f7ecd48e8b07fe54a90757732bf05e106d1a5b89e486c2b36314e1c4f851b86e

  • SSDEEP

    49152:8UYpE9Sa8jnyceXiIEeSavDw9M68bkF2xlEVRv/OiMpe/K7U:ZYpE7KWS49uKY+EVRv/OdpeAU

Score
10/10
r77discoverypersistenceprivilege_escalationrootkit

Malware Config

Targets

    • Target

      setup-w8.1-1.4.6.exe

    • Size

      2.1MB

    • MD5

      938548152c35c028b942b33088d0f3b9

    • SHA1

      6ead124c740dfddc2ab09f1739df760c6d1ee7d3

    • SHA256

      108a8be5260047a10d49105e7f5c22f949bae4e866278b169b66358ea43145ff

    • SHA512

      004bd6ca1e1dbbbe258fe42dcb628607e4a178f09bc40637a9660568953be883f7ecd48e8b07fe54a90757732bf05e106d1a5b89e486c2b36314e1c4f851b86e

    • SSDEEP

      49152:8UYpE9Sa8jnyceXiIEeSavDw9M68bkF2xlEVRv/OiMpe/K7U:ZYpE7KWS49uKY+EVRv/OdpeAU

    Score
    10/10
    r77discoverypersistenceprivilege_escalationrootkit

    • r77

      r77 is an open-source, userland rootkit.

      rootkitr77

    • r77 rootkit payload

      Detects the payload of the r77 rootkit.

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

      persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks