Overview

overview

10

Static

static

5

942de49bc2...a1.exe

windows7-x64

10

942de49bc2...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    942de49bc2304176b3eefae31a59726b3451c60fa9d0e817f3e0d79a25b15ca1

  • Size

    2.4MB

  • Sample

    240703-mn9crasekk

  • MD5

    97f4bfce48908daf8548c94680cdd926

  • SHA1

    b6921fa66184350511ffeac6f7a14308bf830928

  • SHA256

    942de49bc2304176b3eefae31a59726b3451c60fa9d0e817f3e0d79a25b15ca1

  • SHA512

    39ef56903b60a4a67b8863bb2ffdeed934ebe97e8223e16d7135017e20e07575e3a81076104bf37917b0ef6202a69335e66b0c137de83818fbdfb177d52b82e9

  • SSDEEP

    49152:HQqiSbst0sL7R38+1uKnzzaKu4QHNHxU/lAZ1PXiEQMy2vm9ytkB4nX:xstZLNe5Hwl0kDB4n

Score
10/10
discoveryevasionexploitpersistencetrojan

Malware Config

Targets

    • Target

      942de49bc2304176b3eefae31a59726b3451c60fa9d0e817f3e0d79a25b15ca1

    • Size

      2.4MB

    • MD5

      97f4bfce48908daf8548c94680cdd926

    • SHA1

      b6921fa66184350511ffeac6f7a14308bf830928

    • SHA256

      942de49bc2304176b3eefae31a59726b3451c60fa9d0e817f3e0d79a25b15ca1

    • SHA512

      39ef56903b60a4a67b8863bb2ffdeed934ebe97e8223e16d7135017e20e07575e3a81076104bf37917b0ef6202a69335e66b0c137de83818fbdfb177d52b82e9

    • SSDEEP

      49152:HQqiSbst0sL7R38+1uKnzzaKu4QHNHxU/lAZ1PXiEQMy2vm9ytkB4nX:xstZLNe5Hwl0kDB4n

    Score
    10/10
    discoveryevasionexploitpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Possible privilege escalation attempt

      exploit

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

File and Directory Permissions Modification

1
T1222

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks