General
-
Target
c2ee654280ca626d94e8190c83ffb7805ba5f1a0218afd156ba81d478f883935
-
Size
1.5MB
-
Sample
240523-j9czwsaf55
-
MD5
c7fae570cedc28b7cf97d2ad89984325
-
SHA1
c639a07eba85b4b796e53ab856ee4d7aa0845028
-
SHA256
c2ee654280ca626d94e8190c83ffb7805ba5f1a0218afd156ba81d478f883935
-
SHA512
fd088edec225422a6e90d0a4f258039ded9bd89952b362e34cbc8e5d64944ce58171ceab596a8898c931c8c9c5f424f5a44723da645f0a0e9b073073aaae55f0
-
SSDEEP
24576:pLFZeV9rUW3uRIgRNMG88q9s14+6fsqetItnwn56fTvVZo9q:ZFgVIRIgRNMt8qq1bSsqEw/rt
Static task
static1
Behavioral task
behavioral1
Sample
c2ee654280ca626d94e8190c83ffb7805ba5f1a0218afd156ba81d478f883935.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
c2ee654280ca626d94e8190c83ffb7805ba5f1a0218afd156ba81d478f883935
-
Size
1.5MB
-
MD5
c7fae570cedc28b7cf97d2ad89984325
-
SHA1
c639a07eba85b4b796e53ab856ee4d7aa0845028
-
SHA256
c2ee654280ca626d94e8190c83ffb7805ba5f1a0218afd156ba81d478f883935
-
SHA512
fd088edec225422a6e90d0a4f258039ded9bd89952b362e34cbc8e5d64944ce58171ceab596a8898c931c8c9c5f424f5a44723da645f0a0e9b073073aaae55f0
-
SSDEEP
24576:pLFZeV9rUW3uRIgRNMG88q9s14+6fsqetItnwn56fTvVZo9q:ZFgVIRIgRNMt8qq1bSsqEw/rt
-
Modifies firewall policy service
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3