Overview

overview

10

Static

static

7

a972943590...d8.exe

windows7-x64

10

a972943590...d8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a97294359020ade8b49e7189457a9fd8

  • Size

    765KB

  • Sample

    240227-scf5qacc5x

  • MD5

    a97294359020ade8b49e7189457a9fd8

  • SHA1

    2e526abe4e64563e723c557a01106ea40559ffa3

  • SHA256

    6d3239a0892bcb94b2a62d172790e5d433f4d6b32b8ecf8c9e963ea4e4a6f271

  • SHA512

    0675699c1d1975ebea92c9d2468ccb6f4a6d5c5495cb89dd4c9811dbcb728530f0f0fef3447a6b153c397b9f519df22bc346bd872a0c4efb336ce1e0d6562e75

  • SSDEEP

    12288:fSJsWPOGw+qKxNaLIym/P3BANlm2sjynU4q18ympGVZH6Uv/3xqkri/lUy7PU83F:fSrxELIyS3BAN82s0UnjgwBqLNUiM83U

Score
10/10
persistenceupx

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://rerererererere.com/inst.php?id=forbidden

Targets

    • Target

      a97294359020ade8b49e7189457a9fd8

    • Size

      765KB

    • MD5

      a97294359020ade8b49e7189457a9fd8

    • SHA1

      2e526abe4e64563e723c557a01106ea40559ffa3

    • SHA256

      6d3239a0892bcb94b2a62d172790e5d433f4d6b32b8ecf8c9e963ea4e4a6f271

    • SHA512

      0675699c1d1975ebea92c9d2468ccb6f4a6d5c5495cb89dd4c9811dbcb728530f0f0fef3447a6b153c397b9f519df22bc346bd872a0c4efb336ce1e0d6562e75

    • SSDEEP

      12288:fSJsWPOGw+qKxNaLIym/P3BANlm2sjynU4q18ympGVZH6Uv/3xqkri/lUy7PU83F:fSrxELIyS3BAN82s0UnjgwBqLNUiM83U

    Score
    10/10
    persistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks