General
-
Target
99cca441218fe7416251f795e7cc47f7163cfd86207f3924f3cfe252eca595d8
-
Size
145KB
-
Sample
240417-r7x62sec8y
-
MD5
a37929c5cb3882b302684b7d8f238cee
-
SHA1
6b19d192249f5e45440ebabbbcb4c646f6880486
-
SHA256
99cca441218fe7416251f795e7cc47f7163cfd86207f3924f3cfe252eca595d8
-
SHA512
a825198cb22684234b97b44bd07110cb7ffaaafba697948ef8274d1a0604583eeb56af58cc2c99b3bcce14872dc1e1b37e665e67eab4d86c86c0787b76238291
-
SSDEEP
3072:7d5GSFZK6k2cPYRHPaAU6FILQjFsNSLqLaznXiujw:pFZK6krPYlhpIYI2qLKXiOw
Static task
static1
Behavioral task
behavioral1
Sample
b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992.exe
-
Size
229KB
-
MD5
68502dbaf73be1eca888f78e3b06d55a
-
SHA1
14654e87e085e07b91535c7e4e8bc5f41ced65e4
-
SHA256
b557b082890ce023270e4291073976f24d7e68b1ab58890bb95b310785142992
-
SHA512
d87cad3ac8f7f18cb12e63c9bb6a74f29dabf09d5374c64d51ce7a1b3621fd65e454ecf6ff0d0551b80685117b450abf50494b669ad48d5a9906b44e7364d6cb
-
SSDEEP
3072:+nBlv1nZAbXsdUs0vEJier1K2x5b2CZ/P20DMb9rAn5M23R8Gj7mkg+cmH:+nBXk1fmK+G0DMb9rA6Gj7mkHco
Score10/10-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1