General
-
Target
a998ccb2f850f3ea606536c06c525366
-
Size
100KB
-
Sample
240227-trbzzsdh5z
-
MD5
a998ccb2f850f3ea606536c06c525366
-
SHA1
7d18df1d48c75b081966915dd08f50b403b28a33
-
SHA256
28d9a627f5d619cadaf27358d5ed09a011a3ccc7432b317dfe4043372d2fa1b6
-
SHA512
d899f1f75521a439a183202fad1307c2f2b99cc82ddc838dec988b0ad35132c2950ed32e12058b0b52a9e5ca924900f5a709da685444f955fa35d09e5a8c0fb6
-
SSDEEP
3072:QZX7ghzXApJGw1T/3nkBdTOm2aQQg3E8wsaQ7MZlW2:CXUhwz1TATQQWesaQ4rW2
Static task
static1
Behavioral task
behavioral1
Sample
a998ccb2f850f3ea606536c06c525366.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
a998ccb2f850f3ea606536c06c525366
-
Size
100KB
-
MD5
a998ccb2f850f3ea606536c06c525366
-
SHA1
7d18df1d48c75b081966915dd08f50b403b28a33
-
SHA256
28d9a627f5d619cadaf27358d5ed09a011a3ccc7432b317dfe4043372d2fa1b6
-
SHA512
d899f1f75521a439a183202fad1307c2f2b99cc82ddc838dec988b0ad35132c2950ed32e12058b0b52a9e5ca924900f5a709da685444f955fa35d09e5a8c0fb6
-
SSDEEP
3072:QZX7ghzXApJGw1T/3nkBdTOm2aQQg3E8wsaQ7MZlW2:CXUhwz1TATQQWesaQ4rW2
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5