General

  • Target

    spsetup132.exe

  • Size

    4.8MB

  • Sample

    221230-a459taef24

  • MD5

    ae08f40d2d582bab5a94b27e3fe76432

  • SHA1

    42fbc75b7e22c3ba7c4021310e2cdc7f419596c9

  • SHA256

    2c5e4bfa4c934b3795cdc037a9bcda82c7122b9a4b00dab3279b26439aea67e7

  • SHA512

    997d0202e7d6448f9ae8e0381f02314e118c0b61d769b2000bbd7f3469e498ffdf3fd0ee7d0573f725110c6d51cd5c2343251639c29a2bf5282ca02a80911b7f

  • SSDEEP

    98304:yBrA/uapIk1MjEgY74glKJODSNQ/mkGGEAtaTvmqtZVef1oFWf3A8G9:wPiFMjEfwJO+WOAztantZVefiM3A8G9

Malware Config

Targets

    • Target

      spsetup132.exe

    • Size

      4.8MB

    • MD5

      ae08f40d2d582bab5a94b27e3fe76432

    • SHA1

      42fbc75b7e22c3ba7c4021310e2cdc7f419596c9

    • SHA256

      2c5e4bfa4c934b3795cdc037a9bcda82c7122b9a4b00dab3279b26439aea67e7

    • SHA512

      997d0202e7d6448f9ae8e0381f02314e118c0b61d769b2000bbd7f3469e498ffdf3fd0ee7d0573f725110c6d51cd5c2343251639c29a2bf5282ca02a80911b7f

    • SSDEEP

      98304:yBrA/uapIk1MjEgY74glKJODSNQ/mkGGEAtaTvmqtZVef1oFWf3A8G9:wPiFMjEfwJO+WOAztantZVefiM3A8G9

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks