Overview

overview

8

Static

static

4

WS24_0_24_0_ENU.exe

windows7_x64

8

WS24_0_24_0_ENU.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WS24_0_24_0_ENU.exe

  • Size

    621.4MB

  • Sample

    220117-mskj7ahhbk

  • MD5

    1be1eacb79435cef8df74f6d9f80486e

  • SHA1

    e14ed634ff5bd4de32b505cf481e3bde09f5c514

  • SHA256

    c9cfc5a018ba3ed7f99114c31951088b96ba143d0ac262188f38cc40035ebf64

  • SHA512

    32ffb2988fe10a1638752db50a4634cd7a8724e0b9ff8ff28c324f5e817d54b18142bf334a4d279fe30e773d222653c02ca9e0753f7da67114b0e889e4128fb7

Score
8/10
discoverylinkpdfpersistence

Malware Config

Targets

    • Target

      WS24_0_24_0_ENU.exe

    • Size

      621.4MB

    • MD5

      1be1eacb79435cef8df74f6d9f80486e

    • SHA1

      e14ed634ff5bd4de32b505cf481e3bde09f5c514

    • SHA256

      c9cfc5a018ba3ed7f99114c31951088b96ba143d0ac262188f38cc40035ebf64

    • SHA512

      32ffb2988fe10a1638752db50a4634cd7a8724e0b9ff8ff28c324f5e817d54b18142bf334a4d279fe30e773d222653c02ca9e0753f7da67114b0e889e4128fb7

    Score
    8/10
    discoverypersistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks