General
-
Target
a0676802db6968f83ba07079824c0b4e
-
Size
100KB
-
Sample
240221-x9d4vaea9z
-
MD5
a0676802db6968f83ba07079824c0b4e
-
SHA1
890d3c376300d6b5a69b3b730d4643e83e0560e8
-
SHA256
3d607fac9f99e401e69dc3cc2dae7aa3f61de4adbf5e0f0d59f16c7f7442e6ba
-
SHA512
fd56fbce07803ba13bcec193196e26cde690530c82509f625e4bc50aa4b336739dee695480018bb10287d356ad12aa877b47e4653cca35453cf51032655b4a98
-
SSDEEP
3072:y3/gOIMr/njJzIx86/UZlihwYAYk4UVJYyGIUZa:y3/B5vjJzI66/UZlihJAYk4QJY9Za
Static task
static1
Behavioral task
behavioral1
Sample
a0676802db6968f83ba07079824c0b4e.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
a0676802db6968f83ba07079824c0b4e
-
Size
100KB
-
MD5
a0676802db6968f83ba07079824c0b4e
-
SHA1
890d3c376300d6b5a69b3b730d4643e83e0560e8
-
SHA256
3d607fac9f99e401e69dc3cc2dae7aa3f61de4adbf5e0f0d59f16c7f7442e6ba
-
SHA512
fd56fbce07803ba13bcec193196e26cde690530c82509f625e4bc50aa4b336739dee695480018bb10287d356ad12aa877b47e4653cca35453cf51032655b4a98
-
SSDEEP
3072:y3/gOIMr/njJzIx86/UZlihwYAYk4UVJYyGIUZa:y3/B5vjJzI66/UZlihJAYk4QJY9Za
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5