Overview

overview

8

Static

static

SKM_454e20...30.scr

windows7_x64

8

SKM_454e20...30.scr

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SKM_454e20070310530.scr

  • Size

    809KB

  • Sample

    200729-ajwvfwv7we

  • MD5

    f5b3048dd2e673f152d32b45a627f75a

  • SHA1

    231899877604d50a2692781358f090f0fdd21c62

  • SHA256

    b1e971ba689623d9fbc5befb741a9d9e046515a0c05d0adc27a165471bc6303d

  • SHA512

    36d5ee0eeb2472fd5f61ce34906f4b17ae64b609262009e5548697911216aa31f139cf95739cbbbb4036b9ff07de7135cb4bf990b7985e99c6cd6e4ade76c130

Score
8/10
discoveryevasionpersistencespywareupx

Malware Config

Targets

    • Target

      SKM_454e20070310530.scr

    • Size

      809KB

    • MD5

      f5b3048dd2e673f152d32b45a627f75a

    • SHA1

      231899877604d50a2692781358f090f0fdd21c62

    • SHA256

      b1e971ba689623d9fbc5befb741a9d9e046515a0c05d0adc27a165471bc6303d

    • SHA512

      36d5ee0eeb2472fd5f61ce34906f4b17ae64b609262009e5548697911216aa31f139cf95739cbbbb4036b9ff07de7135cb4bf990b7985e99c6cd6e4ade76c130

    Score
    8/10
    upxpersistenceevasionspywarediscovery

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Modifies service

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

2
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Process Discovery

1
T1057

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks