General
-
Target
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56
-
Size
490KB
-
Sample
221126-3dryqacf76
-
MD5
72ae352492e4cafefa98c8196a719b0f
-
SHA1
7d3259dde4abc30529a23ad1c5a4ee7b7f43f560
-
SHA256
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56
-
SHA512
b7b8b55cf2c677ad697a3b37eef54049e7ac8d8b7b4940bf6a0236cffc9072955632935ceaa025c8c9adb2b6295e1eae969a08507171723c627026f523849962
-
SSDEEP
1536:ybcbXVDMo9fgw5Y0ZlUmp/xLVQ8GW9AWPdApTbJ7mLcaQ9yrKYcU:yWMot5Y0Z2enQ8G0AVpTTaOyrv
Static task
static1
Behavioral task
behavioral1
Sample
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56.exe
Resource
win7-20220901-en
Malware Config
Targets
-
-
Target
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56
-
Size
490KB
-
MD5
72ae352492e4cafefa98c8196a719b0f
-
SHA1
7d3259dde4abc30529a23ad1c5a4ee7b7f43f560
-
SHA256
85b314309287c92dce55a504f7f73ec62a9fd80b12ad9e5f477e6ba1f52e0a56
-
SHA512
b7b8b55cf2c677ad697a3b37eef54049e7ac8d8b7b4940bf6a0236cffc9072955632935ceaa025c8c9adb2b6295e1eae969a08507171723c627026f523849962
-
SSDEEP
1536:ybcbXVDMo9fgw5Y0ZlUmp/xLVQ8GW9AWPdApTbJ7mLcaQ9yrKYcU:yWMot5Y0Z2enQ8G0AVpTTaOyrv
-
Modifies firewall policy service
-
Modifies security service
-
Modifies visibility of file extensions in Explorer
-
Modifies visiblity of hidden/system files in Explorer
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-