General
-
Target
ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6
-
Size
1.2MB
-
Sample
221130-2h4mmsbd79
-
MD5
4e87cf628a36e2d160b67954b934b2cc
-
SHA1
f8eae5f87bae52461e2a2a790c058765d5dd9751
-
SHA256
ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6
-
SHA512
9ba4bf4094c03419f844c854c0a9407bbbe809470a66e7fd1f0d22eea64ee89858b68374b8d534f99de197e4f622f324e6c78ae2691b91f4303dd432e6f92f61
-
SSDEEP
24576:yB6A6q4kZl5WRHDP/14mohqsODOeDVs2xS/VtRlw1TVf+tEoJL5LlpcE7my:y6qR9WRjPlohmtxS/Vvlw3olvvD
Static task
static1
Behavioral task
behavioral1
Sample
ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6
-
Size
1.2MB
-
MD5
4e87cf628a36e2d160b67954b934b2cc
-
SHA1
f8eae5f87bae52461e2a2a790c058765d5dd9751
-
SHA256
ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6
-
SHA512
9ba4bf4094c03419f844c854c0a9407bbbe809470a66e7fd1f0d22eea64ee89858b68374b8d534f99de197e4f622f324e6c78ae2691b91f4303dd432e6f92f61
-
SSDEEP
24576:yB6A6q4kZl5WRHDP/14mohqsODOeDVs2xS/VtRlw1TVf+tEoJL5LlpcE7my:y6qR9WRjPlohmtxS/Vvlw3olvvD
Score10/10-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-