General
-
Target
5f33d8e12648b1587cc12ba9270def7b63833bc10041e128bfded6c438e4058c
-
Size
604KB
-
Sample
220731-wh2v6aabh2
-
MD5
8202b93966917230e6fc1f66f2761c18
-
SHA1
eeb91c80cd52416375e86af94734e98546a82072
-
SHA256
5f33d8e12648b1587cc12ba9270def7b63833bc10041e128bfded6c438e4058c
-
SHA512
0477f41c090a19aedf1268fffc02fc1c3ed709a09f4154da0b5658988be3efc023c9ef1e378602946dcbe14a00cf67fa58cd5deed1172bfad1338079fcedfc8c
Static task
static1
Behavioral task
behavioral1
Sample
5f33d8e12648b1587cc12ba9270def7b63833bc10041e128bfded6c438e4058c.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5f33d8e12648b1587cc12ba9270def7b63833bc10041e128bfded6c438e4058c.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-4084403625-2215941253-1760665084-1000\_H_e_l_p_RECOVER_INSTRUCTIONS+oew.txt
http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/8F1C2D1E9DF01C4F
http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/8F1C2D1E9DF01C4F
http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/8F1C2D1E9DF01C4F
http://fwgrhsao3aoml7ej.onion/8F1C2D1E9DF01C4F
Extracted
C:\$Recycle.Bin\S-1-5-21-2372564722-193526734-2636556182-1000\_H_e_l_p_RECOVER_INSTRUCTIONS+urx.txt
http://jj4dhbg4d86sdgrsdfzcadc.ziraimshi.com/C5DFAFA1B8FC926B
http://uu5dbnmsedf4s3jdnfbh34fsdf.parsesun.at/C5DFAFA1B8FC926B
http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/C5DFAFA1B8FC926B
http://fwgrhsao3aoml7ej.onion/C5DFAFA1B8FC926B
Targets
-
-
Target
5f33d8e12648b1587cc12ba9270def7b63833bc10041e128bfded6c438e4058c
-
Size
604KB
-
MD5
8202b93966917230e6fc1f66f2761c18
-
SHA1
eeb91c80cd52416375e86af94734e98546a82072
-
SHA256
5f33d8e12648b1587cc12ba9270def7b63833bc10041e128bfded6c438e4058c
-
SHA512
0477f41c090a19aedf1268fffc02fc1c3ed709a09f4154da0b5658988be3efc023c9ef1e378602946dcbe14a00cf67fa58cd5deed1172bfad1338079fcedfc8c
Score10/10-
Modifies boot configuration data using bcdedit
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-