Overview

overview

10

Static

static

3

41d652145e...e5.exe

windows7-x64

10

41d652145e...e5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff5735fd2989c4a287ab1224205aa5f8.bin

  • Size

    4KB

  • Sample

    240701-ewz52syhrj

  • MD5

    9977d55bfad90644b4566eff1de944a2

  • SHA1

    321f6e05709cc91c07c74d3910b0ba74d52a538a

  • SHA256

    f57b5ca5af9ee9af3126dc7da62143bf0bc280895e4db9cbcbc85676b9081dce

  • SHA512

    6e6078e45ae5327c0387ccd443037d1c34aad7c50494c632747de60eb61d06df4e3680507acd45e07951aeb9958b5da5ab1c4a24704b4f79e35bea987a67ab6b

  • SSDEEP

    96:UKsutKeMxmjPDZq7xjDtPt6yBWxr9ztLh5ZcuaCLy5Uq1UAKL:UNWKetj+xjDlt6y8RJV56CXtAO

Score
10/10
evasionexecutiontrojan

Malware Config

Targets

    • Target

      41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5.exe

    • Size

      11KB

    • MD5

      ff5735fd2989c4a287ab1224205aa5f8

    • SHA1

      dce12b73ab4ce77a8208f30962190defa6e7264c

    • SHA256

      41d652145e82ff966b3a820b490f0fe7d3850c2916c5f4d3522536fec53017e5

    • SHA512

      f6a3dddfffc0277be575131299dfd8f11b91e03d7e72899a99c60e98a7eed34767114b5b0b4c1bc788547657a2a5442705bb60bc828877de06e1a7d39d6d3f60

    • SSDEEP

      192:BY6CytS3WGBZC3S+4TV+G99EalsDfxOCpJx3ptpJ+fl:BY6CytS3WGBg3cTE05lsDc65Q

    Score
    10/10
    evasionexecutiontrojan

    • Modifies security service

      evasion

    • Windows security bypass

      evasiontrojan

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Modify Registry

3
T1112

Impair Defenses

3
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks