General
-
Target
download (28).jpeg
-
Size
19KB
-
Sample
240422-qpdh9abh62
-
MD5
0053d080ee431c29671fa04a5b303da5
-
SHA1
d519916f27d439ba9cc98e7f4c454c5ea6613409
-
SHA256
2000ebc57ec7bcfa6c6a6acb2c7267fb5f19baabf01a7c0fc219741c0792fd00
-
SHA512
13950e451e35f2486b4f063c77cd59a582e240485e1964bfcdee40101bbf5f2524f4e36d2258a807de8f2cc5bcdd9fb073b50768ae4cec9748108ab53acfaf93
-
SSDEEP
384:22A1GtnLJfh7P03n2r0QtrsOhxN3VVazEXooqu2t7XYe3HdLMi/QHU/a:22AanlfdMGr0G1XT8E7VmXR391Ha
Static task
static1
Malware Config
Targets
-
-
Target
download (28).jpeg
-
Size
19KB
-
MD5
0053d080ee431c29671fa04a5b303da5
-
SHA1
d519916f27d439ba9cc98e7f4c454c5ea6613409
-
SHA256
2000ebc57ec7bcfa6c6a6acb2c7267fb5f19baabf01a7c0fc219741c0792fd00
-
SHA512
13950e451e35f2486b4f063c77cd59a582e240485e1964bfcdee40101bbf5f2524f4e36d2258a807de8f2cc5bcdd9fb073b50768ae4cec9748108ab53acfaf93
-
SSDEEP
384:22A1GtnLJfh7P03n2r0QtrsOhxN3VVazEXooqu2t7XYe3HdLMi/QHU/a:22AanlfdMGr0G1XT8E7VmXR391Ha
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4