Overview

overview

10

Static

static

f7c48e04ab...94.exe

windows7-x64

10

f7c48e04ab...94.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194

  • Size

    352KB

  • Sample

    221126-b8pcjada73

  • MD5

    fbd5f1fdda3eeee0a5baf8e863a6852c

  • SHA1

    734b825f09da67e5a1a3f86892c08792a7de7563

  • SHA256

    f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194

  • SHA512

    c5c0421439218671ba132b3d339de9afc5a21403687a3dcdcfbdd0f3dad9d51cfaf7049b6357f7ddebfa51b2badf4325047b73fe60962544653c3fe87ec55c10

  • SSDEEP

    6144:PhfqTIrbbeYoh9DpavsLktcrzsxkOibzVr8SRlEdQFlHfr/4VFh4:oVhHAsEcrz2kPYyEdQFl/UV

Score
10/10
persistence

Malware Config

Targets

    • Target

      f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194

    • Size

      352KB

    • MD5

      fbd5f1fdda3eeee0a5baf8e863a6852c

    • SHA1

      734b825f09da67e5a1a3f86892c08792a7de7563

    • SHA256

      f7c48e04abc1d2cccbeacefe5975aa198c39427274b3d63979b2648d5a023194

    • SHA512

      c5c0421439218671ba132b3d339de9afc5a21403687a3dcdcfbdd0f3dad9d51cfaf7049b6357f7ddebfa51b2badf4325047b73fe60962544653c3fe87ec55c10

    • SSDEEP

      6144:PhfqTIrbbeYoh9DpavsLktcrzsxkOibzVr8SRlEdQFlHfr/4VFh4:oVhHAsEcrz2kPYyEdQFl/UV

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks