General
-
Target
afacb2632d8784016af274fe18140dd4edc038a89e3837b8570a73dc1a1b856e
-
Size
360KB
-
Sample
240121-2ckmksbfc9
-
MD5
43896f9d956ad83ba3773b98374142f3
-
SHA1
b084817d14218928049a8f9c5bcef646aecc8bb3
-
SHA256
afacb2632d8784016af274fe18140dd4edc038a89e3837b8570a73dc1a1b856e
-
SHA512
96a783129f44a398259fd47a38f1ce50e3ab0c62b3b3c900030a18792a02bbed27f875f7df3ccdaeab3b667f0c5c627496665da14373e1ea21d98b3d6cbc7ffd
-
SSDEEP
6144:3rk3p+t3FksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:bk3pcFkRTOzEV6zs1hfk8oYVd+Dj4mYM
Static task
static1
Behavioral task
behavioral1
Sample
afacb2632d8784016af274fe18140dd4edc038a89e3837b8570a73dc1a1b856e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
afacb2632d8784016af274fe18140dd4edc038a89e3837b8570a73dc1a1b856e.exe
Resource
win10-20231215-en
Malware Config
Targets
-
-
Target
afacb2632d8784016af274fe18140dd4edc038a89e3837b8570a73dc1a1b856e
-
Size
360KB
-
MD5
43896f9d956ad83ba3773b98374142f3
-
SHA1
b084817d14218928049a8f9c5bcef646aecc8bb3
-
SHA256
afacb2632d8784016af274fe18140dd4edc038a89e3837b8570a73dc1a1b856e
-
SHA512
96a783129f44a398259fd47a38f1ce50e3ab0c62b3b3c900030a18792a02bbed27f875f7df3ccdaeab3b667f0c5c627496665da14373e1ea21d98b3d6cbc7ffd
-
SSDEEP
6144:3rk3p+t3FksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:bk3pcFkRTOzEV6zs1hfk8oYVd+Dj4mYM
-
Modifies firewall policy service
-
Modifies security service
-
Disables taskbar notifications via registry modification
-
Disables use of System Restore points
-
Looks for VMWare services registry key.
-
Sets file execution options in registry
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Drops desktop.ini file(s)
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1