78a7a05316929dddcba6788429eeec08b5428590b89b8d272bd79471f0b6a4d8

Sharing

Copy URL

Twitter E-mail

General

Target

LogonFuck.exe
Size

8.1MB
Sample

230326-s7whwsba41
MD5

7ee3aeb93b0fa8dc34893e8b3c0f5510
SHA1

faedf76ced4d16de8832d084be985ed8b32cf20d
SHA256

78a7a05316929dddcba6788429eeec08b5428590b89b8d272bd79471f0b6a4d8
SHA512

fba2326c80a69841fa9c97198aa69b0b019fffa591a5f7bd8b38da99f8eb8baa0662c8a4dc751ec38dc7892097175f3b760a7d7e1116aaeeb4b2ffe04b821d29
SSDEEP

196608:WIAlVbD80eclAADocTlPP6H442TXmN1baBwPWQySi6dFNq:FaD80ecaAsqVjlXm7bR+Q95d

Score

8^/10

Malware Config

Targets

- Target
  
  LogonFuck.exe
- Size
  
  8.1MB
- MD5
  
  7ee3aeb93b0fa8dc34893e8b3c0f5510
- SHA1
  
  faedf76ced4d16de8832d084be985ed8b32cf20d
- SHA256
  
  78a7a05316929dddcba6788429eeec08b5428590b89b8d272bd79471f0b6a4d8
- SHA512
  
  fba2326c80a69841fa9c97198aa69b0b019fffa591a5f7bd8b38da99f8eb8baa0662c8a4dc751ec38dc7892097175f3b760a7d7e1116aaeeb4b2ffe04b821d29
- SSDEEP
  
  196608:WIAlVbD80eclAADocTlPP6H442TXmN1baBwPWQySi6dFNq:FaD80ecaAsqVjlXm7bR+Q95d
Score

8^/10

discovery evasion
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Tasks

Sharing

General

Malware Config

Targets

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Checks computer location settings

Modifies file permissions

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10