Overview

overview

10

Static

static

ccb6ffd78c...76.exe

windows7-x64

10

ccb6ffd78c...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976

  • Size

    688KB

  • Sample

    221123-lpqflafd2y

  • MD5

    99f7aea316dece629041e7774d3728cc

  • SHA1

    ed8ce50f94bf28e57c4ebb2fe28cb1c5d5fecc9e

  • SHA256

    ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976

  • SHA512

    ed5afa452b845029e723a863c59e34e789f364749fad1fc30733b1a4adf41f454d0a9fa6d42b9bf4b90834e86f140b1f61f03dfd8318f10d7c08cb9864ba81d9

  • SSDEEP

    6144:GTHFHnDMIH9fJWPnSlRtz+RMpepNFMTHFHnDMIH9fJWPnSlRtz+RMpepNF:GRdBWPmSIeDFMRdBWPmSIeDF

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976

    • Size

      688KB

    • MD5

      99f7aea316dece629041e7774d3728cc

    • SHA1

      ed8ce50f94bf28e57c4ebb2fe28cb1c5d5fecc9e

    • SHA256

      ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976

    • SHA512

      ed5afa452b845029e723a863c59e34e789f364749fad1fc30733b1a4adf41f454d0a9fa6d42b9bf4b90834e86f140b1f61f03dfd8318f10d7c08cb9864ba81d9

    • SSDEEP

      6144:GTHFHnDMIH9fJWPnSlRtz+RMpepNFMTHFHnDMIH9fJWPnSlRtz+RMpepNF:GRdBWPmSIeDFMRdBWPmSIeDF

    Score
    10/10
    evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks