Overview

overview

10

Static

static

HEUR-Troja...et.exe

windows7-x64

10

HEUR-Troja...et.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR-Trojan-Ransom.Win32.PornoAsset.gen-1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

  • Size

    627KB

  • Sample

    221106-f7nf3aecc9

  • MD5

    6528aeb4bc362743ae95a66ccfbdaf8b

  • SHA1

    1f9397b14eed25d1d138ec6259f95c8646e8cb92

  • SHA256

    1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

  • SHA512

    62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

  • SSDEEP

    12288:or3TTrym3e1k7weffYuKm5PScLLgMK1NJbChWI:oT/X3vMeXYuKuSsLg31NNPI

Score
10/10
persistence

Malware Config

Targets

    • Target

      HEUR-Trojan-Ransom.Win32.PornoAsset.gen-1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

    • Size

      627KB

    • MD5

      6528aeb4bc362743ae95a66ccfbdaf8b

    • SHA1

      1f9397b14eed25d1d138ec6259f95c8646e8cb92

    • SHA256

      1c262831ed06eee457cc053a903ac16bc5dfbc11386bf89f1caeedb7d02a3739

    • SHA512

      62e63ae6c8bf9bb93c26470da4f0b2c8ade6fad3d621bbd9c78a449c3caedafe971bbe105790a21cc5f66d0da47c7b4774e31aa1e37dd6ddde422557b694dc74

    • SSDEEP

      12288:or3TTrym3e1k7weffYuKm5PScLLgMK1NJbChWI:oT/X3vMeXYuKuSsLg31NNPI

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks