Overview

overview

8

Static

static

3

78dd0a5e1d...5b.exe

windows7-x64

8

78dd0a5e1d...5b.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    78dd0a5e1d4278b06b53056fabb4de5b

  • Size

    79KB

  • Sample

    240127-bc29hshhg6

  • MD5

    78dd0a5e1d4278b06b53056fabb4de5b

  • SHA1

    b903b8c12278e61d0760ba118041b5bbbccb8764

  • SHA256

    5b5e4ba15e858a1aab912be8b6c48c0040155d2257f21e6fca9e8a025fd788dc

  • SHA512

    3d74dec775fc908073812468abefb92aac23b08e064db1dc2fb487b102cc6175d84e0f3d178fa88b3ffc4bdc91895ba6c7e42f365fcc00733c20c70d3cf33679

  • SSDEEP

    1536:cHReXoVXffIcDpKP1TIoWlvNeGi8iX+SYn6emqmSPc7alBSQV5N:cHRspcCLW9gB+SYn6jqm4c7SNH

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      78dd0a5e1d4278b06b53056fabb4de5b

    • Size

      79KB

    • MD5

      78dd0a5e1d4278b06b53056fabb4de5b

    • SHA1

      b903b8c12278e61d0760ba118041b5bbbccb8764

    • SHA256

      5b5e4ba15e858a1aab912be8b6c48c0040155d2257f21e6fca9e8a025fd788dc

    • SHA512

      3d74dec775fc908073812468abefb92aac23b08e064db1dc2fb487b102cc6175d84e0f3d178fa88b3ffc4bdc91895ba6c7e42f365fcc00733c20c70d3cf33679

    • SSDEEP

      1536:cHReXoVXffIcDpKP1TIoWlvNeGi8iX+SYn6emqmSPc7alBSQV5N:cHRspcCLW9gB+SYn6jqm4c7SNH

    Score
    8/10
    evasionpersistence

    • Disables RegEdit via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks