Overview

overview

10

Static

static

10

7f5c96ca27...3f.exe

windows7-x64

10

7f5c96ca27...3f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f.exe

  • Size

    1.8MB

  • Sample

    240405-bvpq5sgd2w

  • MD5

    a827a96f84fd96ff687d1011c924ff12

  • SHA1

    b7c77ebf0dd9b9276ffa980d19a18d1b38cccac0

  • SHA256

    7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f

  • SHA512

    0bd5643d74c9bd673eacd89e2356596dad638d116b0e6022fcbb462b60609686675ca7f1c93fa6820ee2c6d964bdf085894374a62a401ca056591339f86180f8

  • SSDEEP

    24576:c7Zs3/D1H+cZvKUfcr/hL5Jr/wrFcCZHEbbNEZrKEKe3X:cVsPD1NZbYJ5Jr4Jc8kbikEKe3

Score
10/10
persistence

Malware Config

Targets

    • Target

      7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f.exe

    • Size

      1.8MB

    • MD5

      a827a96f84fd96ff687d1011c924ff12

    • SHA1

      b7c77ebf0dd9b9276ffa980d19a18d1b38cccac0

    • SHA256

      7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f

    • SHA512

      0bd5643d74c9bd673eacd89e2356596dad638d116b0e6022fcbb462b60609686675ca7f1c93fa6820ee2c6d964bdf085894374a62a401ca056591339f86180f8

    • SSDEEP

      24576:c7Zs3/D1H+cZvKUfcr/hL5Jr/wrFcCZHEbbNEZrKEKe3X:cVsPD1NZbYJ5Jr4Jc8kbikEKe3

    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Detects executables packed with ConfuserEx Mod

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks