General
-
Target
01f20033d6ae2256b7c684c5afd4cf931a38db65e9346688de4d7894e34fdc5c
-
Size
145KB
-
Sample
240417-pk5aqsef58
-
MD5
fec3eeba09cbb86a90cb2f6fa1a92ea5
-
SHA1
d4ec8537a218b524524edb171b376eaab01ded15
-
SHA256
01f20033d6ae2256b7c684c5afd4cf931a38db65e9346688de4d7894e34fdc5c
-
SHA512
bf308ee63ff96ef66c16bd99dcb02b4982afce9ab9d84a9be7e2bcc368bd31f57083e1c680d1919e6d998d1b8dc38588b823fd4387a48e1595861201f7f51a65
-
SSDEEP
3072:3vfF8ICt5q1B4ChJTX7Ussl2uxLCpSCsDBrKzyi02LyFv:3F1wwFssQPsWriZo
Static task
static1
Behavioral task
behavioral1
Sample
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be.exe
-
Size
232KB
-
MD5
b5f3dc95c09fa3bfdf009a404736f94e
-
SHA1
03e471e7edf9bbcbe2483ebd1ba05364c93a190a
-
SHA256
f379c2c732470dbce8e17423baf7f6fcca63bcb13c4ade33a15df1225e3841be
-
SHA512
f63cba660384d5296e2f8aeeceba1a2d4707311a242cd5f12220008670cb5c2bf686b546fafe03cc6c5363bd62fe4c067a1f9dc73a8388488e13854b631ee546
-
SSDEEP
6144:j6zxC0r84BWnfZUH7SFcQU+9HFsvKMXOCU:kY0r9BeZUbSiy9HSvKwO
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1