General

  • Target

    install_python.bat

  • Size

    687B

  • Sample

    230531-xlgvtshf69

  • MD5

    821f007d1c56bb3f4511bab928ce8f63

  • SHA1

    a22b0d76f5ef0e145629dded82e195486675774a

  • SHA256

    434f9d4a2a7a5088aa393b47ad8e957a15481cd3078f10b3c0f7ec6fe5f497c2

  • SHA512

    f1db8db20e25d8d06828ead22e70a28411bf32faa7dd14816ef833efe548a046e9383cb51aa100d49555f2cc9c1f74bf10aef871a0e6724da5f96c690770dd4d

Malware Config

Targets

    • Target

      install_python.bat

    • Size

      687B

    • MD5

      821f007d1c56bb3f4511bab928ce8f63

    • SHA1

      a22b0d76f5ef0e145629dded82e195486675774a

    • SHA256

      434f9d4a2a7a5088aa393b47ad8e957a15481cd3078f10b3c0f7ec6fe5f497c2

    • SHA512

      f1db8db20e25d8d06828ead22e70a28411bf32faa7dd14816ef833efe548a046e9383cb51aa100d49555f2cc9c1f74bf10aef871a0e6724da5f96c690770dd4d

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks