General
-
Target
GWBI7H74fhGgtebteb5GSR
-
Size
6.8MB
-
Sample
240618-qcqytayfpj
-
MD5
ab7f07e0cb724902d34ca82aa83e81e3
-
SHA1
becb5b9765615596028a004fc85f70a6064909be
-
SHA256
4e6e5e416417e302fd44f0e1c2106f8aa2c77a24cb363cbf49e12077a641cf6e
-
SHA512
e8e09127eb674403002323e43df20a34125c9ebbcc6cb6da387f5b4f742c2dd1e3cdfa5919d3ce67f16d3bd344313f5ac4a15042f200d83b662bcf036a6d4d9f
-
SSDEEP
196608:w3/NrzAltdolcv92Zg1kOhJmWhxbxiz3bdJqwd9mnC3QLexvLvtGSKFW:aNrnlAUZg1kqJmuxc3BJqs91g6xJGSK0
Behavioral task
behavioral1
Sample
GWBI7H74fhGgtebteb5GSR.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
GWBI7H74fhGgtebteb5GSR.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
GWBI7H74fhGgtebteb5GSR
-
Size
6.8MB
-
MD5
ab7f07e0cb724902d34ca82aa83e81e3
-
SHA1
becb5b9765615596028a004fc85f70a6064909be
-
SHA256
4e6e5e416417e302fd44f0e1c2106f8aa2c77a24cb363cbf49e12077a641cf6e
-
SHA512
e8e09127eb674403002323e43df20a34125c9ebbcc6cb6da387f5b4f742c2dd1e3cdfa5919d3ce67f16d3bd344313f5ac4a15042f200d83b662bcf036a6d4d9f
-
SSDEEP
196608:w3/NrzAltdolcv92Zg1kOhJmWhxbxiz3bdJqwd9mnC3QLexvLvtGSKFW:aNrnlAUZg1kqJmuxc3BJqs91g6xJGSK0
-
Modifies visibility of file extensions in Explorer
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
-
-
Target
out.upx
-
Size
13.6MB
-
MD5
237cc744efbd305b18453922c8a94634
-
SHA1
57f5d08b1295806d783c0940775a6dbf81043e51
-
SHA256
00d55b6913e9adc54c6f5d298a3c53b8ac3d35fa6f6a67d2cf5c01fb7b9958b2
-
SHA512
269687cf85337841ac8c4433cfde0cd4e542d835ab2945c53978e411d3d4e27b16d3554e600511bb4db4d57fc708a09aa943bd6e4843aecad9455a96f21d0aed
-
SSDEEP
98304:gZxlVm3tBoRNfVGzziSJVjEVEjKHmZR3PHIcbkDrsENXir2kvdvRtR0OMGfCCOFE:2rAIRNfoDD4Vk7zPHIunLTRRtPRss
Score1/10 -
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1