Overview

overview

8

Static

static

962a40135d...4a.exe

windows7-x64

8

962a40135d...4a.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    962a40135de9d428e5ab40df994734d90048b4ecfb30b2b4c5db88a27513a14a

  • Size

    298KB

  • Sample

    221125-h9bamaed2s

  • MD5

    93caba46f3c5d9aeb9c9fad652a57361

  • SHA1

    1473a0d514eae8cf4b829d552817becc5acb586a

  • SHA256

    962a40135de9d428e5ab40df994734d90048b4ecfb30b2b4c5db88a27513a14a

  • SHA512

    ce48dee408cc1acc25e15c0e9354b1fa35c30e33a12a6b66346dd0a35d2668a05d5f01ed43be2c1709fbe1dce287e57a30fa18a7983a15b96e2461f334c8d922

  • SSDEEP

    6144:I7YfIbo3sjP3PN/dfomL4ZPba/Oauy26UjD5uL:I7tbSsD31FxCevpzUjD5uL

Score
8/10
persistence

Malware Config

Targets

    • Target

      962a40135de9d428e5ab40df994734d90048b4ecfb30b2b4c5db88a27513a14a

    • Size

      298KB

    • MD5

      93caba46f3c5d9aeb9c9fad652a57361

    • SHA1

      1473a0d514eae8cf4b829d552817becc5acb586a

    • SHA256

      962a40135de9d428e5ab40df994734d90048b4ecfb30b2b4c5db88a27513a14a

    • SHA512

      ce48dee408cc1acc25e15c0e9354b1fa35c30e33a12a6b66346dd0a35d2668a05d5f01ed43be2c1709fbe1dce287e57a30fa18a7983a15b96e2461f334c8d922

    • SSDEEP

      6144:I7YfIbo3sjP3PN/dfomL4ZPba/Oauy26UjD5uL:I7tbSsD31FxCevpzUjD5uL

    Score
    8/10
    persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks for any installed AV software in registry

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Security Software Discovery

1
T1063

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks