Overview

overview

8

Static

static

ISPRoperat...oc.exe

windows7-x64

8

ISPRoperat...oc.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0b85a24980252ba554cb0747af56d6c3e8b8bdc159acbdb0915f5ee9ac90e29

  • Size

    242KB

  • Sample

    221128-c8rckahf47

  • MD5

    bd0a34108676b37d88f8788b37a17f63

  • SHA1

    509cd2c17ff5d74c5bd79efc11021a743955f29b

  • SHA256

    c0b85a24980252ba554cb0747af56d6c3e8b8bdc159acbdb0915f5ee9ac90e29

  • SHA512

    ad630677481cc729b7be94bb4de279d1b102f148b899711b9145c22b916285c2439d50a3b3856982c3c7a57e46d6f478bcfbc0e2404248488f3841ae35fc4846

  • SSDEEP

    6144:2pKK2qwT6cd1PjfwX5ekHfv93zFvBl+fQJyZsMH:6KK2uO1bmMyRlbJ8sMH

Score
8/10
persistence

Malware Config

Targets

    • Target

      ISPRoperationZarbeAzbPMNawazSharifShowedGrief.doc.exe

    • Size

      347KB

    • MD5

      555477e8c9c4003dad42488bff9130e0

    • SHA1

      930f629846253fb7cc40072478942cc4cf81c50b

    • SHA256

      6babfe7d1945253b43fefa09b85330c6a436ae0ee1cddd588923b5984696430d

    • SHA512

      80e1621f56c1d314077f9c8ed5fc015952c7d0280f4b47449328fef637d89a84aee29f460f16c76ea0b0a2cb5a5552d02724504661d53349f2f97221b9df5334

    • SSDEEP

      6144:5a9tGE4Kby8j2xdHlFbqxnGmD55arHH1wuae39FvBl+fQayZsMK:5a9tGEY8ixdHexnGuonwslba8sMK

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks