Overview

overview

8

Static

static

3

untitled.exe

windows7-x64

8

untitled.exe

windows11-21h2-x64

7

Resubmissions

30-11-2024 21:48

241130-1nrpla1jep 8

30-11-2024 21:46

241130-1mnxba1jcm 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    untitled.exe

  • Size

    245KB

  • Sample

    241130-1nrpla1jep

  • MD5

    3d403f366d81c9017ea7242e083dad33

  • SHA1

    d5abdf75c5ed5032b298fd2afb1a29ac97716519

  • SHA256

    04e5c392d9ae6ce39e1181a75f6641ab11a33e2553368fe9d5802813ba5340ca

  • SHA512

    5163ebf669f568d64f4cbbb8f9aec5382064cc0d32b3a603a3d0ac1feafe84c63c978c6092cf6b1c5a89012d6c1aeb3edf397fb96e782dc9c7ba23518fef68dc

  • SSDEEP

    6144:wRywQEWjxXCcL5jrpSiPv6v3T64croHBf:wSGcFJ5wT+CBf

Score
8/10
defense_evasiondiscoveryexploitpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      untitled.exe

    • Size

      245KB

    • MD5

      3d403f366d81c9017ea7242e083dad33

    • SHA1

      d5abdf75c5ed5032b298fd2afb1a29ac97716519

    • SHA256

      04e5c392d9ae6ce39e1181a75f6641ab11a33e2553368fe9d5802813ba5340ca

    • SHA512

      5163ebf669f568d64f4cbbb8f9aec5382064cc0d32b3a603a3d0ac1feafe84c63c978c6092cf6b1c5a89012d6c1aeb3edf397fb96e782dc9c7ba23518fef68dc

    • SSDEEP

      6144:wRywQEWjxXCcL5jrpSiPv6v3T64croHBf:wSGcFJ5wT+CBf

    Score
    8/10
    defense_evasiondiscoveryexploitpersistenceprivilege_escalation

    • Possible privilege escalation attempt

      exploit

    • Modifies file permissions

      discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Drops file in System32 directory

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Power Settings

1
T1653

Privilege Escalation

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Defense Evasion

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

File and Directory Permissions Modification

1
T1222

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

1
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

5
T1012

Remote System Discovery

1
T1018

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks