Overview

overview

10

Static

static

1

apowermirr...-b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    apowermirror-setup-gg-b.exe

  • Size

    1.9MB

  • Sample

    230324-pjhqcaec46

  • MD5

    95f99a7a6ee16bdcc0a8fe120116d7d7

  • SHA1

    ccdb752544c3b1c3cb12319374a3fd0807f2585e

  • SHA256

    7999a1eb0af8b4448598c1e3ace49eaa44cbe2b6266a63e19077e3fb9608c40c

  • SHA512

    de20942292e8e0fcf613d1f3c0eee504fd1426e3cfe8e1a92ae0f207e3b7bc4fbd8a78ee121fec94a7e7fe534bfe4b40a93b11a59d8473222d8bc66ec90e69d8

  • SSDEEP

    49152:myIO6XrnRNm5zuXp7jRG6wLvSpDiTEO3xTuDB14:XIOqrRXG6wL603d

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      apowermirror-setup-gg-b.exe

    • Size

      1.9MB

    • MD5

      95f99a7a6ee16bdcc0a8fe120116d7d7

    • SHA1

      ccdb752544c3b1c3cb12319374a3fd0807f2585e

    • SHA256

      7999a1eb0af8b4448598c1e3ace49eaa44cbe2b6266a63e19077e3fb9608c40c

    • SHA512

      de20942292e8e0fcf613d1f3c0eee504fd1426e3cfe8e1a92ae0f207e3b7bc4fbd8a78ee121fec94a7e7fe534bfe4b40a93b11a59d8473222d8bc66ec90e69d8

    • SSDEEP

      49152:myIO6XrnRNm5zuXp7jRG6wLvSpDiTEO3xTuDB14:XIOqrRXG6wL603d

    Score
    10/10
    discoveryevasionpersistence

    • Modifies firewall policy service

      evasion

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks