General
-
Target
e1c0ffe29210812f126d7d326a73cf48
-
Size
920KB
-
Sample
240327-qg9lqaga4v
-
MD5
e1c0ffe29210812f126d7d326a73cf48
-
SHA1
190bf0423fd2855120e55ecb49faa071a86554c2
-
SHA256
a110fed848ba8216817e1524a20487a9cb0879b4d78104843642196f36fe5f75
-
SHA512
4884e5dd9434c311d55d59613a17e270e2dbe4c2560e122eac91b899d3c4815cf410e2277b013d784655e2eb1c0590707e7ca44651ff6ba500bd10d689420327
-
SSDEEP
24576:zJXWAayET+QuawV+XTUknfiuG7weke8juowZKMnunK:ATzuaxjnsywKMnY
Static task
static1
Behavioral task
behavioral1
Sample
e1c0ffe29210812f126d7d326a73cf48.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
e1c0ffe29210812f126d7d326a73cf48
-
Size
920KB
-
MD5
e1c0ffe29210812f126d7d326a73cf48
-
SHA1
190bf0423fd2855120e55ecb49faa071a86554c2
-
SHA256
a110fed848ba8216817e1524a20487a9cb0879b4d78104843642196f36fe5f75
-
SHA512
4884e5dd9434c311d55d59613a17e270e2dbe4c2560e122eac91b899d3c4815cf410e2277b013d784655e2eb1c0590707e7ca44651ff6ba500bd10d689420327
-
SSDEEP
24576:zJXWAayET+QuawV+XTUknfiuG7weke8juowZKMnunK:ATzuaxjnsywKMnY
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
Disables taskbar notifications via registry modification
-
Drops file in Drivers directory
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Modify Registry
8Hide Artifacts
1Hidden Files and Directories
1