Overview

overview

8

Static

static

1

Anmerkung ...11.png

windows10-ltsc 2021-x64

8

Resubmissions

01-12-2024 00:18

241201-al5wbsvkcr 8

01-12-2024 00:16

241201-akx44azme1 10

30-11-2024 23:57

241130-3zr6lstqdl 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Anmerkung 2024-01-18 231511.png

  • Size

    321KB

  • Sample

    241130-3zr6lstqdl

  • MD5

    921e48fd77add10603c4b4fa4833b3b1

  • SHA1

    702e4a5887419373aeee0db9e41887d52d796bb3

  • SHA256

    faf6dd2652f889431407df47b973dcdfa1d4c790bead60e75b123ea8964cb36e

  • SHA512

    116bb75bde4c692e98cc0735694edb2e0f90b7ed397753b8481a2747fce8bcf43b221d8e955a95941df588091d853214a10c4a347aa798ac60f046cc11ec6a7d

  • SSDEEP

    6144:3iAw0Kz4kgawmXR7RYTwX7DprHlk5+kF1+4TXTYPyNmUZyzeCzGYGfKJrTpWqaJw:XSprXR9Y0FHlk4krFTXMyNmUgiCzGYGw

Score
8/10
defense_evasiondiscoveryevasionexploitpersistencephishingprivilege_escalationtrojan

Malware Config

Targets

    • Target

      Anmerkung 2024-01-18 231511.png

    • Size

      321KB

    • MD5

      921e48fd77add10603c4b4fa4833b3b1

    • SHA1

      702e4a5887419373aeee0db9e41887d52d796bb3

    • SHA256

      faf6dd2652f889431407df47b973dcdfa1d4c790bead60e75b123ea8964cb36e

    • SHA512

      116bb75bde4c692e98cc0735694edb2e0f90b7ed397753b8481a2747fce8bcf43b221d8e955a95941df588091d853214a10c4a347aa798ac60f046cc11ec6a7d

    • SSDEEP

      6144:3iAw0Kz4kgawmXR7RYTwX7DprHlk5+kF1+4TXTYPyNmUZyzeCzGYGfKJrTpWqaJw:XSprXR9Y0FHlk4krFTXMyNmUgiCzGYGw

    Score
    8/10
    defense_evasiondiscoveryevasionexploitpersistencephishingprivilege_escalationtrojan

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Possible privilege escalation attempt

      exploit

    • A potential corporate email address has been identified in the URL: [email protected]

      phishing

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Power Settings

1
T1653

Privilege Escalation

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Defense Evasion

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

File and Directory Permissions Modification

1
T1222

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks