Overview

overview

8

Static

static

1

98icons2.png

windows7-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    98icons2.png

  • Size

    198KB

  • Sample

    241119-tc9byayejl

  • MD5

    aa19ca7850f5138297391ff2ab317456

  • SHA1

    9a83076541b8dd52fccd41bfd2c967046258629f

  • SHA256

    e943849dee32e4ab678d7ef1d00db10549730d50c50f21fe4a772e71d07a4e47

  • SHA512

    ca14fffd03f6ec3e72fec163c0efb33e214368b1343d63bd60398d0c5c31804919cc8660e18accaa449c77463f52993c4462155471bd7f900ba03b5bf2b51e67

  • SSDEEP

    6144:RoKGm0Bt2Xz0U3HZRSmltor71rYaxYB6q3VjHJa:FGm0BU53HZTEnEVTs

Score
8/10
discoverylateral_movementpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      98icons2.png

    • Size

      198KB

    • MD5

      aa19ca7850f5138297391ff2ab317456

    • SHA1

      9a83076541b8dd52fccd41bfd2c967046258629f

    • SHA256

      e943849dee32e4ab678d7ef1d00db10549730d50c50f21fe4a772e71d07a4e47

    • SHA512

      ca14fffd03f6ec3e72fec163c0efb33e214368b1343d63bd60398d0c5c31804919cc8660e18accaa449c77463f52993c4462155471bd7f900ba03b5bf2b51e67

    • SSDEEP

      6144:RoKGm0Bt2Xz0U3HZRSmltor71rYaxYB6q3VjHJa:FGm0BU53HZTEnEVTs

    Score
    8/10
    discoverylateral_movementpersistenceprivilege_escalation

    • Modifies RDP port number used by Windows

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks registry for disk virtualization

      Detecting virtualization disks is order done to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Remote Services: SMB/Windows Admin Shares

      Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

      lateral_movement
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks