General

  • Target

    CairoSetup_64bit.exe

  • Size

    3.5MB

  • Sample

    230331-tkdv1abd59

  • MD5

    1f69e8a557b018eaacbe77d7242095ef

  • SHA1

    afd6f7fc776979f0ff4e36aa243b3a56ba8489e4

  • SHA256

    c84ce4f35dfe0ada475f680551d653d264855a1d477ead3af5c0564e8b74a4a7

  • SHA512

    73c690204af95930e27b29f704f6802ef67a545bbbb41309b70ba5a67b8e3335bab5f6ba6bf7cb72679d4c9c648dff519a1c0c582442a2f955a1b409b30eb984

  • SSDEEP

    49152:6pDzGV9EVA5Nm2VkrORk8+hJplCe7ye1sCqkrH0RKOrCbpS/vFdQ1aNv:6JzGIVATZV7RkplyWq6XOrGS3Qkv

Malware Config

Targets

    • Target

      CairoSetup_64bit.exe

    • Size

      3.5MB

    • MD5

      1f69e8a557b018eaacbe77d7242095ef

    • SHA1

      afd6f7fc776979f0ff4e36aa243b3a56ba8489e4

    • SHA256

      c84ce4f35dfe0ada475f680551d653d264855a1d477ead3af5c0564e8b74a4a7

    • SHA512

      73c690204af95930e27b29f704f6802ef67a545bbbb41309b70ba5a67b8e3335bab5f6ba6bf7cb72679d4c9c648dff519a1c0c582442a2f955a1b409b30eb984

    • SSDEEP

      49152:6pDzGV9EVA5Nm2VkrORk8+hJplCe7ye1sCqkrH0RKOrCbpS/vFdQ1aNv:6JzGIVATZV7RkplyWq6XOrGS3Qkv

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Bootkit

1
T1067

Defense Evasion

Modify Registry

3
T1112

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Tasks