General

  • Target

    winzip27-p003.exe

  • Size

    2.8MB

  • Sample

    230416-gkzq9ahb79

  • MD5

    4ab9bed90bedaace02bb997063a81a2a

  • SHA1

    5778d4dbf5bcf1fd52717c4709de6a3bf9e2c127

  • SHA256

    78e4bbd109f8fa1a87b91769320650acd17bd09b623e4557fb9832ba1a0702d6

  • SHA512

    0463a63dea0b4c81b1f38ca7eb31aad1935e7f1ebcfa7b9878ee62df50e68b2e4695c49a7a2afd14f926ceecd136e90c26a947df8a0c66c669c2f3dd779f9c00

  • SSDEEP

    49152:38csPJkaaLdj1vptksRov0amNesLcYqQJawYLonZkyo7I9+upXrWXld:3TC+HBj1BtksRW0XNPywYLonqyo7I9+h

Malware Config

Targets

    • Target

      winzip27-p003.exe

    • Size

      2.8MB

    • MD5

      4ab9bed90bedaace02bb997063a81a2a

    • SHA1

      5778d4dbf5bcf1fd52717c4709de6a3bf9e2c127

    • SHA256

      78e4bbd109f8fa1a87b91769320650acd17bd09b623e4557fb9832ba1a0702d6

    • SHA512

      0463a63dea0b4c81b1f38ca7eb31aad1935e7f1ebcfa7b9878ee62df50e68b2e4695c49a7a2afd14f926ceecd136e90c26a947df8a0c66c669c2f3dd779f9c00

    • SSDEEP

      49152:38csPJkaaLdj1vptksRov0amNesLcYqQJawYLonZkyo7I9+upXrWXld:3TC+HBj1BtksRW0XNPywYLonqyo7I9+h

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks