General

  • Target

    Windows 10 Rounded by MAKOSTO.rar

  • Size

    2.4MB

  • Sample

    221001-hknjnagfal

  • MD5

    81b84b3f3c1f04754efed7fa187a18c8

  • SHA1

    32fdf026ce6fb8db6ffff6cffc2b084e4e906ef7

  • SHA256

    de85b673f56bea5dd585545d490c028c03756b8d4bb92a5e0e310b46016b5612

  • SHA512

    ccbfb86e3b173f2770d77f70ee227b9337928c4eb77875fe10d0f6dc3ec69a8470196b58137900b612e45a4b018b4407fe44ae3f605e66c22bd65d06ce29a163

  • SSDEEP

    49152:VeZFD30XNkLO8gAqjxZPd7L28KaXkK2IGEX++xXfO2Z/TpRrD/:MFD3sAaFdL28KEkK2I7O+xXfO2JTv/

Malware Config

Targets

    • Target

      Windows 10 Rounded.exe

    • Size

      2.4MB

    • MD5

      11ff322997d98d02afe198c20b613ff3

    • SHA1

      48e70395f187454bddc01484a6cbcf1c5f1753fc

    • SHA256

      9482be3fcb23242751dfc68c1f239c92de3999618ca2d3ae0d7c9f5f596876f4

    • SHA512

      11cc64b00f741b44c73c835e6da3c103d4a690e1c6c009cd020967e870967f31bd2ad8851f4e0d2a2c6e964558665e84d33839f82db2e178053d7ffb5b191ee4

    • SSDEEP

      49152:DXNPtf+dAGSXAZGxgF3Nr13EfePGBT5OHTdg5K6EnCN11Y:DPxD5g1p9keGLc+SH

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • Possible privilege escalation attempt

    • Registers COM server for autorun

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Modifies file permissions

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

2
T1112

File Permissions Modification

1
T1222

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks