General

  • Target

    c5dbb25fa983a695d1c13210e2ff0948

  • Size

    478KB

  • Sample

    240313-phhzqacg21

  • MD5

    c5dbb25fa983a695d1c13210e2ff0948

  • SHA1

    6c3803d46b259b684cb785ea71ea2196aabe9d61

  • SHA256

    7c2d6857361e13e7324493776903df6a455695bf15e0452ab92001f1e200c419

  • SHA512

    856c39a2b2c2296039d418c15e4eec368aebc9a8ea68bdfdaa4479f715e4b65903a1928c09fe71b3287b9c960693ffc5784a3c7d25cf48bd1260f151cebc20a5

  • SSDEEP

    6144:xYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO0B3pgSUGX1Y:xSNC80I+cR3R03VseuOiZgSNY

Malware Config

Targets

    • Target

      c5dbb25fa983a695d1c13210e2ff0948

    • Size

      478KB

    • MD5

      c5dbb25fa983a695d1c13210e2ff0948

    • SHA1

      6c3803d46b259b684cb785ea71ea2196aabe9d61

    • SHA256

      7c2d6857361e13e7324493776903df6a455695bf15e0452ab92001f1e200c419

    • SHA512

      856c39a2b2c2296039d418c15e4eec368aebc9a8ea68bdfdaa4479f715e4b65903a1928c09fe71b3287b9c960693ffc5784a3c7d25cf48bd1260f151cebc20a5

    • SSDEEP

      6144:xYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO0B3pgSUGX1Y:xSNC80I+cR3R03VseuOiZgSNY

    • Modifies WinLogon for persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks