General
-
Target
1f313f8a0fb1d37f3d7d0b53a6e5bd70
-
Size
145KB
-
Sample
231225-bf9g1afeak
-
MD5
1f313f8a0fb1d37f3d7d0b53a6e5bd70
-
SHA1
64c89ea4b19bdc85f5f0c9b49430635c7a077d0a
-
SHA256
34f86c5d8ad41ae37d6e843f884a8261ad2c55534f5635ddf368f65323b3dbcf
-
SHA512
db0a50953b83b88f1594096ce7cad35d6bde8a562708eb016cae091eb931af614dcd9d363618223bbeadb1c929ccdf10733470502d38516fdcc1f6292e61546e
-
SSDEEP
384:beRq2+Te7vMw5Qm/w96XsIDnN7oE8INlRe0h9kVWJVXiM2+3iY:KRKyMw5QKXsYcYlhbWWJIsi
Behavioral task
behavioral1
Sample
1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
1f313f8a0fb1d37f3d7d0b53a6e5bd70
-
Size
145KB
-
MD5
1f313f8a0fb1d37f3d7d0b53a6e5bd70
-
SHA1
64c89ea4b19bdc85f5f0c9b49430635c7a077d0a
-
SHA256
34f86c5d8ad41ae37d6e843f884a8261ad2c55534f5635ddf368f65323b3dbcf
-
SHA512
db0a50953b83b88f1594096ce7cad35d6bde8a562708eb016cae091eb931af614dcd9d363618223bbeadb1c929ccdf10733470502d38516fdcc1f6292e61546e
-
SSDEEP
384:beRq2+Te7vMw5Qm/w96XsIDnN7oE8INlRe0h9kVWJVXiM2+3iY:KRKyMw5QKXsYcYlhbWWJIsi
Score10/10-
Modifies WinLogon for persistence
-
Drops file in Drivers directory
-
Sets service image path in registry
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2