Overview

overview

8

Static

static

69f52a8bdb...91.exe

windows7-x64

8

69f52a8bdb...91.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69f52a8bdbe8e91423585b24bff8abe6acea43221a39b98f517ae57be226cf91

  • Size

    65KB

  • Sample

    221123-xpj5csaf21

  • MD5

    571d52bc7401a718028fec84451e2070

  • SHA1

    51a6c0402cfded7892d1c44be87fb73f708219f9

  • SHA256

    69f52a8bdbe8e91423585b24bff8abe6acea43221a39b98f517ae57be226cf91

  • SHA512

    22d5700d523c49340e79efe7a7d74399742aa3bee1d613857ebf54b97f9bb361785723ef809aca469c58891f58b44405fdea9f8f06fcf251aadfbed31162536d

  • SSDEEP

    768:4a4r+PpHfXGLOFCk6SLARI+WEkFfsEjUPIOuJI5R7FMAnXMcMaJIWmS2zIzV9xJv:sr+Fum5LMI+WTJjcXnXMcpm/zOxJXKJY

Score
8/10

Malware Config

Targets

    • Target

      69f52a8bdbe8e91423585b24bff8abe6acea43221a39b98f517ae57be226cf91

    • Size

      65KB

    • MD5

      571d52bc7401a718028fec84451e2070

    • SHA1

      51a6c0402cfded7892d1c44be87fb73f708219f9

    • SHA256

      69f52a8bdbe8e91423585b24bff8abe6acea43221a39b98f517ae57be226cf91

    • SHA512

      22d5700d523c49340e79efe7a7d74399742aa3bee1d613857ebf54b97f9bb361785723ef809aca469c58891f58b44405fdea9f8f06fcf251aadfbed31162536d

    • SSDEEP

      768:4a4r+PpHfXGLOFCk6SLARI+WEkFfsEjUPIOuJI5R7FMAnXMcMaJIWmS2zIzV9xJv:sr+Fum5LMI+WTJjcXnXMcpm/zOxJXKJY

    Score
    8/10

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks