General

  • Target

    Logon_overwriter.exe

  • Size

    266KB

  • Sample

    231116-19stsabf6t

  • MD5

    08d52877fd68e4de576b54515330a900

  • SHA1

    2404b3245e591b3e55badd8addf78f18ae8ff3b7

  • SHA256

    1f934e5ee7286e177226e282041c445cd88060032edb4f2ff0cd9a10c26b0722

  • SHA512

    3164c40f644a6bd4c955a66e83ac0dc84780963c97aa7001dc734b8e2e0579bb768de0820465ca6fed6b89ce19897b44dc30d072663ac9bdda59d35ea14b2cf1

  • SSDEEP

    6144:pbpdyCIzMEZ4DQ0SsG4+7WO7WfdyCIzMEZ4DQ0SsG4Nq:glzMKwKaOaIlzMKwQ

Score
8/10

Malware Config

Targets

    • Target

      Logon_overwriter.exe

    • Size

      266KB

    • MD5

      08d52877fd68e4de576b54515330a900

    • SHA1

      2404b3245e591b3e55badd8addf78f18ae8ff3b7

    • SHA256

      1f934e5ee7286e177226e282041c445cd88060032edb4f2ff0cd9a10c26b0722

    • SHA512

      3164c40f644a6bd4c955a66e83ac0dc84780963c97aa7001dc734b8e2e0579bb768de0820465ca6fed6b89ce19897b44dc30d072663ac9bdda59d35ea14b2cf1

    • SSDEEP

      6144:pbpdyCIzMEZ4DQ0SsG4+7WO7WfdyCIzMEZ4DQ0SsG4Nq:glzMKwKaOaIlzMKwQ

    Score
    8/10
    • Possible privilege escalation attempt

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks