Overview

overview

10

Static

static

1

photosync_setup.exe

windows7-x64

4

photosync_setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    photosync_setup.exe

  • Size

    5.9MB

  • Sample

    230923-ddzwwsca2v

  • MD5

    a4e8d8c838ffc19e0ea227abacd2b5d2

  • SHA1

    4372afa05a0a8cc241af5593e48d6904e2423e88

  • SHA256

    c05163a1b43b0111c167363f2510dfdf726d30c9c8b0a91c98e2cb8cd8a4fdbc

  • SHA512

    b929c14fdb10a889707391c8f4ade27905593f7d562464d5595d9578d18c8e93084c1eb5f17488ed94c66fa3d0a71469f9ef4f1c1676356fb93a9fd1f5bd6f31

  • SSDEEP

    98304:eQsuCfBBecaPT4IMQ8wVDaDsBJ2hqpcutkSYhmJ262lZoV4wn/Si4nYrxuDzKQb:eQzqBBedPT4IMQ8EDYMtWk2LcV4SAYrq

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      photosync_setup.exe

    • Size

      5.9MB

    • MD5

      a4e8d8c838ffc19e0ea227abacd2b5d2

    • SHA1

      4372afa05a0a8cc241af5593e48d6904e2423e88

    • SHA256

      c05163a1b43b0111c167363f2510dfdf726d30c9c8b0a91c98e2cb8cd8a4fdbc

    • SHA512

      b929c14fdb10a889707391c8f4ade27905593f7d562464d5595d9578d18c8e93084c1eb5f17488ed94c66fa3d0a71469f9ef4f1c1676356fb93a9fd1f5bd6f31

    • SSDEEP

      98304:eQsuCfBBecaPT4IMQ8wVDaDsBJ2hqpcutkSYhmJ262lZoV4wn/Si4nYrxuDzKQb:eQzqBBedPT4IMQ8EDYMtWk2LcV4SAYrq

    Score
    10/10
    discoveryevasionpersistence

    • Modifies firewall policy service

      evasion

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks