89cc026f98feadc56ef6ff6068c06b8ba1b723feed88b6b5c07b0c6733f4bd44 | Triage

Sharing

General

Target

PISUNGOVNO.exe
Size

578KB
Sample

240706-j78c1svbrd
MD5

af68a885c579a1e4b7fec2d67254fb90
SHA1

cbba23e160ba0f759a38bc7681ce4aec53f3d220
SHA256

89cc026f98feadc56ef6ff6068c06b8ba1b723feed88b6b5c07b0c6733f4bd44
SHA512

47cd596aafd7fd5a80d18315a38d3a6415a68d19e3cfc4ed41111a20a4881ee3358bf923564a636936c8c51c3de41a786b60e254497c33618b769914ac349155
SSDEEP

6144:NQuFa77aQWHdYKtE09hviWW50RlPyx/3kcHGe6VlWT8b9U73VsPQkK6UVs/k8b5R:TA7rtG65gydSPVle8ot6UVsYXQFDkW

Score

10^/10

android evasion execution macos persistence privilege_escalation

Malware Config

Targets

- Target
  
  PISUNGOVNO.exe
- Size
  
  578KB
- MD5
  
  af68a885c579a1e4b7fec2d67254fb90
- SHA1
  
  cbba23e160ba0f759a38bc7681ce4aec53f3d220
- SHA256
  
  89cc026f98feadc56ef6ff6068c06b8ba1b723feed88b6b5c07b0c6733f4bd44
- SHA512
  
  47cd596aafd7fd5a80d18315a38d3a6415a68d19e3cfc4ed41111a20a4881ee3358bf923564a636936c8c51c3de41a786b60e254497c33618b769914ac349155
- SSDEEP
  
  6144:NQuFa77aQWHdYKtE09hviWW50RlPyx/3kcHGe6VlWT8b9U73VsPQkK6UVs/k8b5R:TA7rtG65gydSPVle8ot6UVsYXQFDkW
Score

10^/10

execution persistence privilege_escalation evasion
- Modifies WinLogon for persistence
  persistence
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

AppInit DLLs

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

AppInit DLLs

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Hide Artifacts

Resource Forking

Credential Access

Discovery

System Information Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

executionpersistenceprivilege_escalation

behavioral2

executionpersistenceprivilege_escalation

behavioral3

executionpersistenceprivilege_escalation

behavioral4

persistenceprivilege_escalation

behavioral5

executionpersistenceprivilege_escalation

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16