Overview

overview

10

Static

static

10

The-MALWAR...on.txt

windows7-x64

3

The-MALWAR...2aed41

windows7-x64

3

The-MALWAR...ka.exe

windows7-x64

7

The-MALWAR...if.exe

windows7-x64

10

The-MALWAR...il.exe

windows7-x64

8

The-MALWAR...at.exe

windows7-x64

1

The-MALWAR...98.exe

windows7-x64

1

The-MALWAR...aj.exe

windows7-x64

7

The-MALWAR...jB.exe

windows7-x64

7

The-MALWAR...om.exe

windows7-x64

6

The-MALWAR...1C.exe

windows7-x64

5

The-MALWAR...90.exe

windows7-x64

8

The-MALWAR...6a.exe

windows7-x64

8

The-MALWAR...it.exe

windows7-x64

1

The-MALWAR...ng.exe

windows7-x64

7

The-MALWAR....a.exe

windows7-x64

10

The-MALWAR...1A.exe

windows7-x64

8

The-MALWAR...as.exe

windows7-x64

6

The-MALWAR...te.exe

windows7-x64

7

The-MALWAR....a.exe

windows7-x64

3

The-MALWAR...le.exe

windows7-x64

3

The-MALWAR...us.exe

windows7-x64

10

The-MALWAR...er.exe

windows7-x64

7

The-MALWAR...ff.exe

windows7-x64

3

Analysis

  • max time kernel
    140s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 21:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    The-MALWARE-Repo-master/Worm/Fagot.a.exe

  • Size

    373KB

  • MD5

    30cdab5cf1d607ee7b34f44ab38e9190

  • SHA1

    d4823f90d14eba0801653e8c970f47d54f655d36

  • SHA256

    1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

  • SHA512

    b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

  • SSDEEP

    6144:Bjrk71gCl5D0nIMpAP40ShG4TmvgFNwUQs4zTBrgDYZJPSLJXaUtjk10he1:S79l5DixAPzwjegFNwVJzTLPSLJXT

Score
10/10
adwaredefense_evasiondiscoveryevasionpersistenceprivilege_escalationstealertrojan

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
    persistence
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 36 IoCs
    evasion
  • Modifies security service 2 TTPs 22 IoCs
    evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 28 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 12 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 43 IoCs
    persistence
  • Manipulates Digital Signatures 1 TTPs 64 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 4 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Modifies system executable filetype association 2 TTPs 53 IoCs
    persistence
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Indicator Removal: Clear Persistence 1 TTPs 43 IoCs

    remove IFEO.

    defense_evasion
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies WinLogon 2 TTPs 13 IoCs
    persistence
  • Drops file in System32 directory 25 IoCs
  • Drops file in Windows directory 1 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 21 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • System policy modification 1 TTPs 9 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Worm\Fagot.a.exe
    "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Worm\Fagot.a.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Modifies WinLogon for persistence
    • Modifies firewall policy service
    • Modifies security service
    • Boot or Logon Autostart Execution: Active Setup
    • Boot or Logon Autostart Execution: Port Monitors
    • Event Triggered Execution: Image File Execution Options Injection
    • Manipulates Digital Signatures
    • Boot or Logon Autostart Execution: Print Processors
    • Impair Defenses: Safe Mode Boot
    • Modifies system executable filetype association
    • Windows security modification
    • Adds Run key to start application
    • Indicator Removal: Clear Persistence
    • Installs/modifies Browser Helper Object
    • Maps connected drives based on registry
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Event Triggered Execution: Netsh Helper DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • System policy modification
    PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

7
T1547

Active Setup

1
T1547.014

Port Monitors

1
T1547.010

Print Processors

1
T1547.012

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Browser Extensions

1
T1176

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

3
T1546

Change Default File Association

1
T1546.001

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

7
T1547

Active Setup

1
T1547.014

Port Monitors

1
T1547.010

Print Processors

1
T1547.012

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

3
T1546

Change Default File Association

1
T1546.001

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Safe Mode Boot

1
T1562.009

Indicator Removal

1
T1070

Clear Persistence

1
T1070.009

Modify Registry

14
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\bootok.exe
    Filesize

    373KB

    MD5

    30cdab5cf1d607ee7b34f44ab38e9190

    SHA1

    d4823f90d14eba0801653e8c970f47d54f655d36

    SHA256

    1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

    SHA512

    b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

    Download Submit

  • memory/2096-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2096-15-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

    Download