General
-
Target
902c0748e8911632a43a2e04d40b79c5
-
Size
9.1MB
-
Sample
240204-z35z4adabj
-
MD5
902c0748e8911632a43a2e04d40b79c5
-
SHA1
52c6149f9c6be70e0abdd48d82e890a49d96765d
-
SHA256
3a41ebcd198dde9831095a035abb241bff819739976a7e481fa9b384ec73439f
-
SHA512
1e613a1cdc166593f3fa8f97c9027669be28401a4c0acb41dbccba1d1ba186157af8f703eb44535971d8e3d092746b00a447e2e2e5314929b3147fa26269b0ae
-
SSDEEP
196608:UOvErjzQNFtqB3T7YpBtGo84ChWcn7txAdYcNM75JGf6q5QLBkb7ty55:UKE/U/u3TsUR4CFn7txAdla7lKQq855
Static task
static1
Behavioral task
behavioral1
Sample
zhugeqm.exe
Resource
win7-20231215-en
Malware Config
Targets
-
-
Target
zhugeqm.exe
-
Size
9.2MB
-
MD5
85032a9876284e13f8f748026ce93654
-
SHA1
bdff1fed5522a107a5a2c7a40e1a8e72ae6c0c3d
-
SHA256
711296508c03f942d3f238ae0b0edd4c0c10520343d63abae6590022684ee71c
-
SHA512
cd0f9fbaae8ddbb874b8ecc9adadba91be27fbb05f11886e47ba5057110a8bf15b19a903aafe73dfbb71cc17018c75db6755998448e8259b9a1dcf348876129e
-
SSDEEP
196608:J5s3DVso/7ZT7AqDubJ0hVq/zG30SVuVnM:J5sTVso/7ZT5DFhlEaOnM
-
Modifies firewall policy service
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1