Overview

overview

10

Static

static

3

SnuVy Spoof.exe

windows10-ltsc 2021-x64

10

Resubmissions

22-11-2024 04:44

241122-fcs33azrfr 8

22-11-2024 04:11

241122-erzzgstqg1 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SnuVy Spoof.exe

  • Size

    746KB

  • Sample

    241122-erzzgstqg1

  • MD5

    65b0e91512cc8d241ecc81dcba75d018

  • SHA1

    3552fd50d9db83ba21abc56c6cd986637c3df51f

  • SHA256

    9d3219f467a2616a7e6844ecbb0df5c5dddf8536d444691bd2c18bb899092eb2

  • SHA512

    5ef4fa0cb5645a2f6582e20f2e21b770737ae2938a8b609131ea6cefef269b938d5b2ca70713af8f071e5d3a04778e5b01a975f4b2e5f44090245c70aed9b017

  • SSDEEP

    12288:qr8DUq79BdXaHsLXqltIRIyr50UaGIdlijbZVIE:qrYUOBp5XqltmP6UaGEkj3

Score
10/10
defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      SnuVy Spoof.exe

    • Size

      746KB

    • MD5

      65b0e91512cc8d241ecc81dcba75d018

    • SHA1

      3552fd50d9db83ba21abc56c6cd986637c3df51f

    • SHA256

      9d3219f467a2616a7e6844ecbb0df5c5dddf8536d444691bd2c18bb899092eb2

    • SHA512

      5ef4fa0cb5645a2f6582e20f2e21b770737ae2938a8b609131ea6cefef269b938d5b2ca70713af8f071e5d3a04778e5b01a975f4b2e5f44090245c70aed9b017

    • SSDEEP

      12288:qr8DUq79BdXaHsLXqltIRIyr50UaGIdlijbZVIE:qrYUOBp5XqltmP6UaGEkj3

    Score
    10/10
    defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

    • Deletes NTFS Change Journal

      The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

      ransomware

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Stops running service(s)

      evasionexecution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Power Settings

1
T1653

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Indicator Removal

3
T1070

Clear Windows Event Logs

1
T1070.001

File Deletion

2
T1070.004

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

Remote System Discovery

1
T1018

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Data Destruction

1
T1485

Inhibit System Recovery

3
T1490

Service Stop

1
T1489

Tasks