Overview

overview

9

Static

static

3

spoofer.exe

windows10-2004-x64

9

spoofer.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    spoofer.exe
  • Size 11.5MB
  • Sample261009-1cs4aacv2p
  • SHA256 71e4e36cbd5ef5182b2619eba567766c63866ed00b74c8d4ba0f2356b6725f1a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      spoofer.exe
    • Size 11.5MB
    • SHA256 71e4e36cbd5ef5182b2619eba567766c63866ed00b74c8d4ba0f2356b6725f1a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Modifies Windows Firewall

      defense_evasion

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

Windows Command Shell

1
T1059.003

Windows Management Instrumentation

2
T1047

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Virtualization/Sandbox Evasion

3
T1497

System Checks

1
T1497.001

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

3
T1082

System Network Configuration Discovery

1
T1016

Virtualization/Sandbox Evasion

3
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks