Overview

overview

7

Static

static

3

4932262152...aa.exe

windows7-x64

7

4932262152...aa.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4932262152b570800f0e595a0034ee2305edef7ed1d1e7914b771a40ea03c9aa

  • Size

    472KB

  • Sample

    240305-yvd1zagb3t

  • MD5

    322e4700befb566eba9229da6658b653

  • SHA1

    1248ee6b70b64c941d3bb9bde4cfdf28231894d8

  • SHA256

    4932262152b570800f0e595a0034ee2305edef7ed1d1e7914b771a40ea03c9aa

  • SHA512

    d0ebb218cd78e026ace19ca6850509cc84e87a933454d7eaaa0db6e2adbad9e512c77213bc2e58acf95e800d749fe573a806817020a33653f31a38a8560fdf4c

  • SSDEEP

    6144:cf+Jjjou35J6i5plrzuo6/LkeYvjoIHnv0RX/VwFdLD/7MsrYMC+9GXL9M8sG3dr:bj8u3ui5pl+uBvc/V0FdYxJdRqMv

Score
7/10
persistence

Malware Config

Targets

    • Target

      4932262152b570800f0e595a0034ee2305edef7ed1d1e7914b771a40ea03c9aa

    • Size

      472KB

    • MD5

      322e4700befb566eba9229da6658b653

    • SHA1

      1248ee6b70b64c941d3bb9bde4cfdf28231894d8

    • SHA256

      4932262152b570800f0e595a0034ee2305edef7ed1d1e7914b771a40ea03c9aa

    • SHA512

      d0ebb218cd78e026ace19ca6850509cc84e87a933454d7eaaa0db6e2adbad9e512c77213bc2e58acf95e800d749fe573a806817020a33653f31a38a8560fdf4c

    • SSDEEP

      6144:cf+Jjjou35J6i5plrzuo6/LkeYvjoIHnv0RX/VwFdLD/7MsrYMC+9GXL9M8sG3dr:bj8u3ui5pl+uBvc/V0FdYxJdRqMv

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks