General

  • Target

    soothing-ambience-with-breathtaking-waterfall.3840x2160.mp4

  • Size

    71.5MB

  • Sample

    240520-kq38eacc26

  • MD5

    79805ff09b39ffb00542d66137de92c1

  • SHA1

    24ad71cbf72d8db182c96ed0480254525dcc8903

  • SHA256

    cad3f5316132f8a8156d79bafba843eed53e34b07bb4757f83c9e0abc77251ba

  • SHA512

    6d81d2dca8de9a42bd90088799624b63cbf88b08a81278830a4d31aadca3a2d6256c1e4a7a907d89962c1d730e9f4e7ace8fb23fa7498a49158a57338174cef7

  • SSDEEP

    1572864:hWTp+3p3zIg5c2eNqr1zjHRvR20yN0DYzb8vu9Luyo:OpQhzIgOPNqr1PRvXUXA3

Malware Config

Targets

    • Target

      soothing-ambience-with-breathtaking-waterfall.3840x2160.mp4

    • Size

      71.5MB

    • MD5

      79805ff09b39ffb00542d66137de92c1

    • SHA1

      24ad71cbf72d8db182c96ed0480254525dcc8903

    • SHA256

      cad3f5316132f8a8156d79bafba843eed53e34b07bb4757f83c9e0abc77251ba

    • SHA512

      6d81d2dca8de9a42bd90088799624b63cbf88b08a81278830a4d31aadca3a2d6256c1e4a7a907d89962c1d730e9f4e7ace8fb23fa7498a49158a57338174cef7

    • SSDEEP

      1572864:hWTp+3p3zIg5c2eNqr1zjHRvR20yN0DYzb8vu9Luyo:OpQhzIgOPNqr1PRvXUXA3

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks