Overview

overview

10

Static

static

3

updater.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    updater.exe

  • Size

    13KB

  • Sample

    240225-tezwaafc69

  • MD5

    7a9f5a6e4d5723186f55ab704d9ee966

  • SHA1

    9bc120f944dba8dfc3ec872458aca98ddf30ea7d

  • SHA256

    4ec1e55e7a91761c4a7aa4604dda7b57f1fc34913ab4f900a7c5dc2651308f49

  • SHA512

    e129823bd6e65d5d8bbae0d20f21912e4d2c0a7a19fd2278562c2815b4c89224ecd1c869a375ddea5c0a7a8e8aba3f69eb0ec4de96bc04fad866231ad8a6afbc

  • SSDEEP

    192:EzevFV3UmPtnoQWmq7uD+b55tfhD9ODnop:EzqFvFV8uelODop

Score
10/10
persistence

Malware Config

Targets

    • Target

      updater.exe

    • Size

      13KB

    • MD5

      7a9f5a6e4d5723186f55ab704d9ee966

    • SHA1

      9bc120f944dba8dfc3ec872458aca98ddf30ea7d

    • SHA256

      4ec1e55e7a91761c4a7aa4604dda7b57f1fc34913ab4f900a7c5dc2651308f49

    • SHA512

      e129823bd6e65d5d8bbae0d20f21912e4d2c0a7a19fd2278562c2815b4c89224ecd1c869a375ddea5c0a7a8e8aba3f69eb0ec4de96bc04fad866231ad8a6afbc

    • SSDEEP

      192:EzevFV3UmPtnoQWmq7uD+b55tfhD9ODnop:EzqFvFV8uelODop

    Score
    10/10
    persistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Registers new Windows logon scripts automatically executed at logon.

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks