Overview

overview

9

Static

static

1

02ad87e946...dc.lnk

windows7-x64

8

02ad87e946...dc.lnk

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02ad87e946a127508c1741205a106e1a05da79f5b20ec10bf1507aae01f949dc.lnk

  • Size

    2KB

  • Sample

    241127-cfrsmaxnhm

  • MD5

    464e2f94ac97b9bf225d303e0d05f114

  • SHA1

    d8511f96d21071b1d5a4cf923ba84ed1fb67df46

  • SHA256

    02ad87e946a127508c1741205a106e1a05da79f5b20ec10bf1507aae01f949dc

  • SHA512

    e3e3d3aa76c7d7fc7af1f3d3e339eb3c255d25858fce413479cf8ba43af7137d88dc5cf2127c4b24e30973d65bdd5b76cb9fd0c187604c609f6a1a8438725ff6

Score
9/10
defense_evasiondiscoveryexecutionlateral_movement

Malware Config

Targets

    • Target

      02ad87e946a127508c1741205a106e1a05da79f5b20ec10bf1507aae01f949dc.lnk

    • Size

      2KB

    • MD5

      464e2f94ac97b9bf225d303e0d05f114

    • SHA1

      d8511f96d21071b1d5a4cf923ba84ed1fb67df46

    • SHA256

      02ad87e946a127508c1741205a106e1a05da79f5b20ec10bf1507aae01f949dc

    • SHA512

      e3e3d3aa76c7d7fc7af1f3d3e339eb3c255d25858fce413479cf8ba43af7137d88dc5cf2127c4b24e30973d65bdd5b76cb9fd0c187604c609f6a1a8438725ff6

    Score
    9/10
    executiondefense_evasiondiscoverylateral_movement

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Remote Service Session Hijacking: RDP Hijacking

      Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

      lateral_movement

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Indicator Removal: Network Share Connection Removal

      Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Drops file in System32 directory

    • Hide Artifacts: Hidden Users

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

PowerShell

2
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Account Manipulation

1
T1098

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Account Manipulation

1
T1098

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

1
T1564

Hidden Users

1
T1564.002

Indicator Removal

1
T1070

Network Share Connection Removal

1
T1070.005

Modify Registry

1
T1112

Credential Access

Discovery

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Query Registry

3
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Remote Service Session Hijacking

1
T1563

RDP Hijacking

1
T1563.002

Collection

Command and Control

Exfiltration

Impact

Tasks