Overview

overview

10

Static

static

3

b14ae1dd5d...f3.exe

windows7-x64

10

b14ae1dd5d...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b14ae1dd5d9e275f4206cc8eefc1f15130f3981aef3b9035b76f9a6559a233f3

  • Size

    205KB

  • Sample

    241121-fx6jwszdjp

  • MD5

    b6ac49d55c1a26bd29fd8306257b512f

  • SHA1

    23cccc09b0b56b5c4119ce8833c3b629cc38e1c5

  • SHA256

    b14ae1dd5d9e275f4206cc8eefc1f15130f3981aef3b9035b76f9a6559a233f3

  • SHA512

    bc730922cf76cf76ac18b4860a26db2f8792073ac7fd0c4f794949930708630f0ba528cac2f0605a09fd8ee0f69edf6df8f777ad541862b57d7914aa6631af79

  • SSDEEP

    768:NHP/0gh1VgRDfqkLOpONM+EoiKv35BMCD:FTBiuPONM+R5f

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      b14ae1dd5d9e275f4206cc8eefc1f15130f3981aef3b9035b76f9a6559a233f3

    • Size

      205KB

    • MD5

      b6ac49d55c1a26bd29fd8306257b512f

    • SHA1

      23cccc09b0b56b5c4119ce8833c3b629cc38e1c5

    • SHA256

      b14ae1dd5d9e275f4206cc8eefc1f15130f3981aef3b9035b76f9a6559a233f3

    • SHA512

      bc730922cf76cf76ac18b4860a26db2f8792073ac7fd0c4f794949930708630f0ba528cac2f0605a09fd8ee0f69edf6df8f777ad541862b57d7914aa6631af79

    • SSDEEP

      768:NHP/0gh1VgRDfqkLOpONM+EoiKv35BMCD:FTBiuPONM+R5f

    Score
    10/10
    discoveryevasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables cmd.exe use via registry modification

      evasion

    • Drops file in Drivers directory

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks