Overview

overview

10

Static

static

fb9ead1d8b...81.exe

windows7-x64

10

fb9ead1d8b...81.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81

  • Size

    162KB

  • Sample

    221127-jsp8wsef8t

  • MD5

    f6710a928e7c123887bf5716b6ce3d72

  • SHA1

    78ff43711800f8b55c90053ee469f317d5456855

  • SHA256

    fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81

  • SHA512

    948ca2b3fe6cf09dff33576b748d12812b97d6e85d9ec3b2cab91148c3d38c5fdcef6fcca8d2295d47bc9e19332eec0ec312b675460b5c52143ad40affb07742

  • SSDEEP

    3072:SATjMpxXxgGvYskJLRiuyVisMekmUd0aIjwJczcvuo+wxmiAY/:BTjMpz6qnQ0b7gu1wE

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81

    • Size

      162KB

    • MD5

      f6710a928e7c123887bf5716b6ce3d72

    • SHA1

      78ff43711800f8b55c90053ee469f317d5456855

    • SHA256

      fb9ead1d8b0d7e26264e73d190c190bec35b3e31ebf74bee17c84514c29a3a81

    • SHA512

      948ca2b3fe6cf09dff33576b748d12812b97d6e85d9ec3b2cab91148c3d38c5fdcef6fcca8d2295d47bc9e19332eec0ec312b675460b5c52143ad40affb07742

    • SSDEEP

      3072:SATjMpxXxgGvYskJLRiuyVisMekmUd0aIjwJczcvuo+wxmiAY/:BTjMpz6qnQ0b7gu1wE

    Score
    10/10
    evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks