General
-
Target
b2580cc725e45150d8bd087753752555d3f0cc48849e1075e874ab0d32066f16
-
Size
141KB
-
Sample
240417-p7jmjshf91
-
MD5
7995dd096b8ceb4fbf315650c5a2667f
-
SHA1
ffdeb23e2ba9208d9825881c76b2b2afb6545fa5
-
SHA256
b2580cc725e45150d8bd087753752555d3f0cc48849e1075e874ab0d32066f16
-
SHA512
4ac0cbd9cdcc8b8537dd3b932775c054869902c8529b214d16ffadbe0de6a5efb92cbc10d195da1183920ef7e9002a168e2079d4f341075539a014cebbfd27d3
-
SSDEEP
3072:Yv3Fm978anM8eUf2CieTrGpfP7pSIaC6VYR:rwAf2CRTrKP+eR
Static task
static1
Behavioral task
behavioral1
Sample
a7c2b8d081407da5d72f12eeef21c11674ff616c89be40f73f114c292c09e6de.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a7c2b8d081407da5d72f12eeef21c11674ff616c89be40f73f114c292c09e6de.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
a7c2b8d081407da5d72f12eeef21c11674ff616c89be40f73f114c292c09e6de.exe
-
Size
227KB
-
MD5
1010b86bd744c31ecef5f5aeae5ca6df
-
SHA1
79dbaab22a85e8a0c3124d39423da1ca24c358e8
-
SHA256
a7c2b8d081407da5d72f12eeef21c11674ff616c89be40f73f114c292c09e6de
-
SHA512
6823068623029c10aa0d833be8422b6d93663832d24298bd9811f7700bbc56dc5463fd75f12273e2168bac6784a16e735cc86cf0de8841e83c1befc75bdfd02d
-
SSDEEP
3072:BG/VLLNVnlMoDjq0sg0lpb15L76ZhBUrIeGskK+KgPcf53whT5A/hTu:8Lh9ljdOlPB6tUrIK+zPcRaCpT
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1