Overview

overview

8

Static

static

ca43548571...b7.exe

windows7-x64

8

ca43548571...b7.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8252227374.zip

  • Size

    372KB

  • Sample

    221028-j7smkafae4

  • MD5

    9ed89a99562f0cfdca0c775e28252673

  • SHA1

    3503f925f529d8cc01a2a81b1cbd48f65dff42dc

  • SHA256

    02cd50f68856d39dd5ab3b3acceccce693c165280d81d5f63ece721fcb5b1524

  • SHA512

    d45e7963d1aa4ee5854e2f7d922812ed3d7a2ee75291692ef892bd7c537060e5bfca2932d186d85d37f176c56014aa63e0db453a74a50ac7560baeae4c237eb9

  • SSDEEP

    6144:dewE5LvUYz2/kb6sTt7BHymCq99IHEqWr6iB1fWbB1qT16uK8YjcZyXQrgRJaWT3:dnKLsYz28tp7BHymCq99IHEzrDvWbfyc

Score
8/10
persistence

Malware Config

Targets

    • Target

      ca43548571c559a85f937635951c1ebd2a26d2ad84a8cc96f669d6b48fd2b9b7

    • Size

      838KB

    • MD5

      c96d5487277ca5bf6f24520f8e391822

    • SHA1

      4280f1ada0111c007639df85803374f83467c3ff

    • SHA256

      ca43548571c559a85f937635951c1ebd2a26d2ad84a8cc96f669d6b48fd2b9b7

    • SHA512

      42808a2aeda9be51f00403a20c665689fc288310e0aed0530bdce6e13c595670b16a6c3c461b146f2fa9f7033940741151bc0bef793f96a03541c259d230a4e5

    • SSDEEP

      6144:uX/cDU0fVh+/5bcBg7Z5ZItm8tn0rGM6rgGQm3da3NQRuvJaA/fUBPXnXGcbjJ1Y:vUX156m88GG0dqawahPHPQQq

    Score
    8/10
    persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks