Overview

overview

9

Static

static

1

c2c5837094...77.lnk

windows7-x64

8

c2c5837094...77.lnk

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2c5837094cd8de442e49235887ce10e31e9f7ccc39af67235cfd548e7a1a177.lnk

  • Size

    2KB

  • Sample

    241127-dhhheazqer

  • MD5

    4a658619a07a5237c0e85b75bf14e644

  • SHA1

    089a04cc3a66c5b86ddbb6a481c5ab8702c1e621

  • SHA256

    c2c5837094cd8de442e49235887ce10e31e9f7ccc39af67235cfd548e7a1a177

  • SHA512

    88e0b970b2da52b263ecd6008a58df1094ce1acac03bd1358afad0d99daa6c3f89c32122451a3f6632f42db70541b3982ecaff046eda569968ed6ffd2879a394

Score
9/10
defense_evasiondiscoveryexecutionlateral_movement

Malware Config

Targets

    • Target

      c2c5837094cd8de442e49235887ce10e31e9f7ccc39af67235cfd548e7a1a177.lnk

    • Size

      2KB

    • MD5

      4a658619a07a5237c0e85b75bf14e644

    • SHA1

      089a04cc3a66c5b86ddbb6a481c5ab8702c1e621

    • SHA256

      c2c5837094cd8de442e49235887ce10e31e9f7ccc39af67235cfd548e7a1a177

    • SHA512

      88e0b970b2da52b263ecd6008a58df1094ce1acac03bd1358afad0d99daa6c3f89c32122451a3f6632f42db70541b3982ecaff046eda569968ed6ffd2879a394

    Score
    9/10
    executiondefense_evasiondiscoverylateral_movement

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Remote Service Session Hijacking: RDP Hijacking

      Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

      lateral_movement

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Indicator Removal: Network Share Connection Removal

      Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Drops file in System32 directory

    • Hide Artifacts: Hidden Users

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

PowerShell

2
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Account Manipulation

1
T1098

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Account Manipulation

1
T1098

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

1
T1564

Hidden Users

1
T1564.002

Indicator Removal

1
T1070

Network Share Connection Removal

1
T1070.005

Modify Registry

1
T1112

Credential Access

Discovery

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Remote Service Session Hijacking

1
T1563

RDP Hijacking

1
T1563.002

Collection

Command and Control

Exfiltration

Impact

Tasks