f30ea0f7276100d02319bee64445888af5d784eb12a962ea88f99d2ae4137897

Sharing

Copy URL Twitter E-mail

General

Target
Individual Components.zip
Size 23.9MB
Sample240302-3d17dsag33
SHA256 f30ea0f7276100d02319bee64445888af5d784eb12a962ea88f99d2ae4137897
MD5 f949dd5dafce6af3c7b259a33fd6a63d
SHA1 22d00d8c5d3c377c1dff4d5cea0a78f79e84c052
SHA512 0a3d3ea21448cdedcf4fb139aea239edc8621d91a200bcb5c4ba54ab1e6eb95165b6fbf49457a796ff98f5903685b55304e44f976288d67b558ffae1357647b2
SSDEEP 393216:dMvRIppwpu4lXNO208Odt0i9i6WZuwo4bPdbf9bdTyVyclN/bq4n3DVc1GKU:6vowpJlMXoxxg2blPYN/bq4n3DAU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Targets

- Target
  MicrosoftWindowsServicesEtc/AppKill.bat
- Size 671B
- SHA256 5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
- MD5 d4e987817d2e5d6ed2c12633d6f11101
- SHA1 3f38430a028f9e3cb66c152e302b3586512dd9c4
- SHA512 b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2
- Target
  MicrosoftWindowsServicesEtc/CallFunc.vbs
- Size 388B
- SHA256 a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275
- MD5 5f9737f03289963a6d7a71efab0813c4
- SHA1 ba22dfae8d365cbf8014a630f23f1d8574b5cf85
- SHA512 5f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a
- MD5 SHA1 SHA512
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  MicrosoftWindowsServicesEtc/DgzRun.vbs
- Size 341B
- SHA256 729f7540887cf32a5d4e1968a284c46cf904752821c734bd970ecd30a848477a
- MD5 a91417f7c55510155771f1f644dd6c7e
- SHA1 41bdb69c5baca73f49231d5b5f77975b79e55bdf
- SHA512 f786699c1ab9d7c74dd9eb9d76a76728980b29e84999a166a47b7ee102d8e545901ed0fcb30331712490a36de2d726115b661ad3900cdc2bfcfc601d00b76b07
- MD5 SHA1 SHA512
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  MicrosoftWindowsServicesEtc/GetReady.exe
- Size 52KB
- SHA256 5319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725
- MD5 57f3795953dafa8b5e2b24ba5bfad87f
- SHA1 47719bd600e7527c355dbdb053e3936379d1b405
- SHA512 172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98
- SSDEEP 1536:Sn1KqRJ9x3jnIbslu8JFNDfIDIO40nToIfqqjw0:Sn1KUhrIbsTIl4YTBfqQ
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery exploit
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
behavioral7 behavioral8
- Target
  MicrosoftWindowsServicesEtc/Major.exe
- Size 60KB
- SHA256 da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d
- MD5 d604c29940864c64b4752d31e2deb465
- SHA1 c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3
- SHA512 89a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54
- SSDEEP 768:jfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQ/:4IxKWLvFn43bovQtu7qo43jjRDf4h/q
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  MicrosoftWindowsServicesEtc/NotMuch.exe
- Size 122KB
- SHA256 cf830a2d66d3ffe51341de9e62c939b2bb68583afbc926ddc7818c3a71e80ebb
- MD5 87a43b15969dc083a0d7e2ef73ee4dd1
- SHA1 657c7ff7e3f325bcbc88db9499b12c636d564a5f
- SHA512 8a02d24f5dab33cdaf768bca0d7a1e3ea75ad515747ccca8ee9f7ffc6f93e8f392ab377f7c2efa5d79cc0b599750fd591358a557f074f3ce9170283ab5b786a1
- SSDEEP 3072:V/mYyX16rSVvl/zCQXMdUQLK21J/mYyX16rSVvl/zCQXMdUQLK211:0j6mvLCQXM1L/wj6mvLCQXM1L/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  MicrosoftWindowsServicesEtc/RuntimeChecker.exe
- Size 58KB
- SHA256 51f59e877a1c2a1c2760c677def7395ef2868c2ee3e56ffdc3ace570afa50428
- MD5 cd58990b1b7f6c68f56244c41ab91665
- SHA1 7ccca9958d6aebbe3883b55f115b041b827bd2e7
- SHA512 011bdd417ec3bf72daa2b32d3816b696be8b87423740dc2a0182e23515651deeb870a94f3415a73480145f9f5e36c1a3a492410b77ca95d7fab8b9826e9198cc
- SSDEEP 768:HfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQB:8IxKWLvFn43bovQtu7qo43jjRDf4e
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  MicrosoftWindowsServicesEtc/WinScrew.exe
- Size 52KB
- SHA256 429e01b0e06b02a55bafb1527629f8d4c5f64d9b21ac9f81484a3928fdce6dc9
- MD5 1aaafedd9f259acca75708f4af10b5be
- SHA1 f6b4ea28d304e1f9205c1c0b970d60ee989402f2
- SHA512 a995ebf4d142452aabb419f0cacfa5412d03532840cb08c37dd7c00001dee521bf9d0da66ac4346b07dffd91fe01fa3115fa05811acbd43d380320dca1be4aa8
- SSDEEP 1536:Sn1KqRJ9x3jnIbslu8JFNDfIDIO40nToIfqFwr:Sn1KUhrIbsTIl4YTBfqa
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery exploit
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  MicrosoftWindowsServicesEtc/breakrule.exe
- Size 58KB
- SHA256 5eafebd52fbf6d0e8abd0cc9bf42d36e5b6e4d85b8ebe59f61c9f2d6dccc65e4
- MD5 bcb0ac4822de8aeb86ea8a83cd74d7ca
- SHA1 8e2b702450f91dde3c085d902c09dd265368112e
- SHA512 b73647a59eeb92f95c4d7519432ce40ce9014b292b9eb1ed6a809cca30864527c2c827fe49c285bb69984f33469704424edca526f9dff05a6244b33424df01d1
- SSDEEP 768:TfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQ5:oIxKWLvFn43bovQtu7qo43jjRDf45OP
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18
- Target
  MicrosoftWindowsServicesEtc/bsod.exe
- Size 1.2MB
- SHA256 6581eeab9fd116662b4ca73f6ef00fb96e0505d01cfb446ee4b32bbdeefe1361
- MD5 8f6a3b2b1af3a4aacd8df1734d250cfe
- SHA1 505b3bd8e936cb5d8999c1b319951ffebab335c9
- SHA512 c1b5f845c005a1a586080e9da9744e30c7f3eda1e3aaba9c351768f7dea802e9f39d0227772413756ab63914ae4a2514e6ce52c494a91e92c3a1f08badb40264
- SSDEEP 24576:Zo4RxLUqi0cq0wQvNuPmLanpxJML1m2rVF9VoEzdWcKgl7xAYKTj6fi6QkGC3BQ:WopPL0bMmLYpxJTWxVoSoLglla6fiFc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  MicrosoftWindowsServicesEtc/checker.bat
- Size 151B
- SHA256 3382484b5a6a04d05500e7622da37c1ffaef3a1343395942bc7802bf2a19b53f
- MD5 f59801d5c49713770bdb2f14eff34e2f
- SHA1 91090652460c3a197cfad74d2d3c16947d023d63
- SHA512 c1c3a78f86e7938afbe391f0e03065b04375207704e419fe77bf0810d1e740c3ef8926c878884ad81b429ec41e126813a68844f600e124f5fa8d28ef17b4b7bc
- MD5 SHA1 SHA512
Score

1^/10
behavioral21 behavioral22
- Target
  MicrosoftWindowsServicesEtc/data/eula32.exe
- Size 1.2MB
- SHA256 c5704419b3eec34fb133cf2509d12492febdcb8831efa1ab014edeac83f538d9
- MD5 cbc127fb8db087485068044b966c76e8
- SHA1 d02451bd20b77664ce27d39313e218ab9a9fdbf9
- SHA512 200ee39287f056b504cc23beb1b301a88b183a3806b023d936a2d44a31bbfd08854f6776082d4f7e2232c3d2f606cd5d8229591ecdc86a2bbcfd970a1ee33d41
- SSDEEP 24576:ltxcvBKhCBmx66TPABwaktzXYjg6lks6TMHeAKHDZlwtH8eQ2d:2v0hC5ePtakt70gS1tBKHDZloH8eb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  MicrosoftWindowsServicesEtc/data/runner32s.exe
- Size 58KB
- SHA256 a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4
- MD5 87815289b110cf33af8af1decf9ff2e9
- SHA1 09024f9ec9464f56b7e6c61bdd31d7044bdf4795
- SHA512 8d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc
- SSDEEP 768:nfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQR:cIxKWLvFn43bovQtu7qo43jjRDf4e
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral25 behavioral26
- Target
  MicrosoftWindowsServicesEtc/example.txt
- Size 302B
- SHA256 cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
- MD5 8837818893ce61b6730dd8a83d625890
- SHA1 a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
- SHA512 6f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
- MD5 SHA1 SHA512
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral27 behavioral28
- Target
  MicrosoftWindowsServicesEtc/fexec.vbs
- Size 2KB
- SHA256 f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f
- MD5 fd76266c8088a4dca45414c36c7e9523
- SHA1 6b19bf2904a0e3b479032e101476b49ed3ae144a
- SHA512 3cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30
- Target
  MicrosoftWindowsServicesEtc/healgen.vbs
- Size 302B
- SHA256 cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
- MD5 8837818893ce61b6730dd8a83d625890
- SHA1 a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
- SHA512 6f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
- MD5 SHA1 SHA512
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Possible privilege escalation attempt

Checks computer location settings

Modifies file permissions

Checks computer location settings

Checks computer location settings

Possible privilege escalation attempt

Checks computer location settings

Modifies file permissions

Drops file in System32 directory

Checks computer location settings

Checks computer location settings

Checks computer location settings

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32