Overview

overview

10

Static

static

3

e0a30f2c32...3c.exe

windows7-x64

10

e0a30f2c32...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0a30f2c32754a4a4a79b13ff0b5e03c

  • Size

    1.7MB

  • Sample

    240327-dvex2see4t

  • MD5

    e0a30f2c32754a4a4a79b13ff0b5e03c

  • SHA1

    1360a9cd73566cbff17f4227e3edc1294b82b45d

  • SHA256

    274857d62ace68dfc99693252fc4e5cca95f8308d04fc09e84e6d36ae5be03fa

  • SHA512

    02237d6736f915e89aa60b86a6a09aa02ea9dc2cb3e4ba8c24932212ff66464f2981a1275513809d4e8ea9605c012abf7fa1a170d9e49e4dbdafc322fc0dc05c

  • SSDEEP

    49152:PK/rgBg1pOCjLIx4uRZjxPgw5a1pxyupW:uEKNjTuRdJgua1pxw

Score
10/10
evasionpersistence

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://pcguarrantorutility.com/favicon.ico?0=72&1=0&2=1&3=62&4=i-s&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000

Extracted

Language
hta
Source
URLs
hta.dropper

http://pcguarrantorutility.com/favicon.ico?0=72&1=0&2=1&3=62&4=i-s&5=9200&6=6&7=2&8=919041&9=1033&10=0&11=0000

Targets

    • Target

      e0a30f2c32754a4a4a79b13ff0b5e03c

    • Size

      1.7MB

    • MD5

      e0a30f2c32754a4a4a79b13ff0b5e03c

    • SHA1

      1360a9cd73566cbff17f4227e3edc1294b82b45d

    • SHA256

      274857d62ace68dfc99693252fc4e5cca95f8308d04fc09e84e6d36ae5be03fa

    • SHA512

      02237d6736f915e89aa60b86a6a09aa02ea9dc2cb3e4ba8c24932212ff66464f2981a1275513809d4e8ea9605c012abf7fa1a170d9e49e4dbdafc322fc0dc05c

    • SSDEEP

      49152:PK/rgBg1pOCjLIx4uRZjxPgw5a1pxyupW:uEKNjTuRdJgua1pxw

    Score
    10/10
    evasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Sets file execution options in registry

      persistence

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks