Resubmissions

25-04-2024 04:47

240425-fezzdsfg4z 8

25-04-2024 04:44

240425-fdbv6sfe82 7

25-04-2024 04:30

240425-e42zlsfc57 8

25-04-2024 04:26

240425-e2hg7afb98 8

25-04-2024 04:23

240425-ez875afd3v 7

General

  • Target

    SpySheriff.exe

  • Size

    403KB

  • Sample

    240425-ez875afd3v

  • MD5

    c899f93e8b753fedd068ef3fe2edb0fd

  • SHA1

    144b1f18d0e307d14937c21ca1d7cbfc91828a10

  • SHA256

    5c2a85fb56de2e0a1a1d260ef2177e0209477586c8a6740494bbaf40a9785f47

  • SHA512

    1aceacb4eba0815322dd3fcd273d8703408362eee3b2d2b5981d2abbe4c2b02852608f46b2e7ce46a50e921871d445c239014b5957c6ba0606bd0334ce7bd41b

  • SSDEEP

    12288:eBMDMf+ztV53y2k9I68iXDycz+rYIYsVRSHsDr:eS4S53h68eIZjD

Malware Config

Targets

    • Target

      SpySheriff.exe

    • Size

      403KB

    • MD5

      c899f93e8b753fedd068ef3fe2edb0fd

    • SHA1

      144b1f18d0e307d14937c21ca1d7cbfc91828a10

    • SHA256

      5c2a85fb56de2e0a1a1d260ef2177e0209477586c8a6740494bbaf40a9785f47

    • SHA512

      1aceacb4eba0815322dd3fcd273d8703408362eee3b2d2b5981d2abbe4c2b02852608f46b2e7ce46a50e921871d445c239014b5957c6ba0606bd0334ce7bd41b

    • SSDEEP

      12288:eBMDMf+ztV53y2k9I68iXDycz+rYIYsVRSHsDr:eS4S53h68eIZjD

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

5
T1012

System Information Discovery

5
T1082

Tasks