Overview

overview

10

Static

static

1

IMG_202302...03.jpg

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IMG_20230226_135503.jpg

  • Size

    1.3MB

  • Sample

    230320-qned6aff8y

  • MD5

    7b19ed42641b00795a13d6d82b3a338a

  • SHA1

    943141da3963066e584624e5330a7183023e675d

  • SHA256

    6cca04bcf7e42bc36ca7dd57ebbe325ee8df68673faadfced32e1f9cc9cc9327

  • SHA512

    3a650e7de39d78c7389b39ca18d0471e16cf7890f8d2c2d15528cb8bf7cc6f76aaefa6367c54314dad46a02391f437041e6eef2341aae117347145f05f52c03b

  • SSDEEP

    24576:VJMlhzmYxewYkVk9huWbWxxZhGPtLYaH00YBcHePvr3GS:ValtMwbeaWbMZYqaH03BcHeTJ

Score
10/10
googlepersistencephishing

Malware Config

Targets

    • Target

      IMG_20230226_135503.jpg

    • Size

      1.3MB

    • MD5

      7b19ed42641b00795a13d6d82b3a338a

    • SHA1

      943141da3963066e584624e5330a7183023e675d

    • SHA256

      6cca04bcf7e42bc36ca7dd57ebbe325ee8df68673faadfced32e1f9cc9cc9327

    • SHA512

      3a650e7de39d78c7389b39ca18d0471e16cf7890f8d2c2d15528cb8bf7cc6f76aaefa6367c54314dad46a02391f437041e6eef2341aae117347145f05f52c03b

    • SSDEEP

      24576:VJMlhzmYxewYkVk9huWbWxxZhGPtLYaH00YBcHePvr3GS:ValtMwbeaWbMZYqaH03BcHeTJ

    Score
    10/10
    googlepersistencephishing

    • Detected google phishing page

      phishinggoogle

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks