Overview

overview

10

Static

static

ff8ae91899...1f.exe

windows7-x64

10

ff8ae91899...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff8ae91899534e791d7fad592057fc7a6b93c15f4353bdc776ffafe52bbe261f

  • Size

    254KB

  • Sample

    221124-tt44jseh96

  • MD5

    6ab62f02376a8e61aa23144755d54056

  • SHA1

    1ca2ed88f11cca6933349a7c214186a8aa520a5a

  • SHA256

    ff8ae91899534e791d7fad592057fc7a6b93c15f4353bdc776ffafe52bbe261f

  • SHA512

    897547a860c656d9d37cb30936dc771be24c420160d37d70856dde74b1a0e442e2d76459c301b0f7b1cbe1a86ce04ba6f136dc5e16d9c3bae33a40863db9e5ff

  • SSDEEP

    6144:uwBgCOamGnqnz3HgGXp6GIyTgGYTgnnOx0:tgcmGnqnzQGZ6GIyTrWgnnU

Score
10/10
persistence

Malware Config

Targets

    • Target

      ff8ae91899534e791d7fad592057fc7a6b93c15f4353bdc776ffafe52bbe261f

    • Size

      254KB

    • MD5

      6ab62f02376a8e61aa23144755d54056

    • SHA1

      1ca2ed88f11cca6933349a7c214186a8aa520a5a

    • SHA256

      ff8ae91899534e791d7fad592057fc7a6b93c15f4353bdc776ffafe52bbe261f

    • SHA512

      897547a860c656d9d37cb30936dc771be24c420160d37d70856dde74b1a0e442e2d76459c301b0f7b1cbe1a86ce04ba6f136dc5e16d9c3bae33a40863db9e5ff

    • SSDEEP

      6144:uwBgCOamGnqnz3HgGXp6GIyTgGYTgnnOx0:tgcmGnqnzQGZ6GIyTrWgnnU

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks for any installed AV software in registry

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks