General
-
Target
Peki Spoofer V4.exe
-
Size
548KB
-
Sample
240425-yc4tnsdh83
-
MD5
c711b8ca38bb8185a6d6e41c38070538
-
SHA1
465826e7cbc72487a4885e325a21d4ec66a1bdcf
-
SHA256
ea1ac23002a691f0822ba54c6624f518251d946492ef1ef5c9286959d86b968b
-
SHA512
7579d576be88908b70f23e1e33c99162090339a8b5a2dfec9212b82845b50bfa84dfaec431abd4ec0a169701c4cde93d3552851d53421eb2ab1517001b5338a0
-
SSDEEP
12288:EQ1UK4SmbfMcsgJqyE/KWcRTTjyRrn/FvPF:EQ1rmrMZ8WcJHyVN
Static task
static1
Behavioral task
behavioral1
Sample
Peki Spoofer V4.exe
Resource
win11-20240412-en
Malware Config
Targets
-
-
Target
Peki Spoofer V4.exe
-
Size
548KB
-
MD5
c711b8ca38bb8185a6d6e41c38070538
-
SHA1
465826e7cbc72487a4885e325a21d4ec66a1bdcf
-
SHA256
ea1ac23002a691f0822ba54c6624f518251d946492ef1ef5c9286959d86b968b
-
SHA512
7579d576be88908b70f23e1e33c99162090339a8b5a2dfec9212b82845b50bfa84dfaec431abd4ec0a169701c4cde93d3552851d53421eb2ab1517001b5338a0
-
SSDEEP
12288:EQ1UK4SmbfMcsgJqyE/KWcRTTjyRrn/FvPF:EQ1rmrMZ8WcJHyVN
Score10/10-
Nirsoft
-
Downloads MZ/PE file
-
Sets DLL path for service in the registry
-
Stops running service(s)
-
Executes dropped EXE
-
Registers COM server for autorun
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1