General

  • Target

    file_shredder_setup.exe

  • Size

    2.2MB

  • Sample

    240618-tvk23avglq

  • MD5

    38debb1ffd53d8c1c00a972d2c5e6676

  • SHA1

    8e6ed5bc7c0f07559f82f381cc9f8c8e5f5d9da8

  • SHA256

    72714927de74b97c524c5fa8bc1a0dec83f038dbbed80b93b5e6280ca1317f41

  • SHA512

    dd1132ac929030da10dfa3a1dd0005e5b33f1c6b2269c0256070fe618046dadcde5a9e5818bdbdaf108dde11217a08e7adfc4c7dd37d0e88ce6d6291a167ae3d

  • SSDEEP

    49152:JKgtpyoMSglFselNx/Uf3+O4/fL2MO5rgZznQeVa:NtpVglFBUGj2xGR7c

Malware Config

Targets

    • Target

      file_shredder_setup.exe

    • Size

      2.2MB

    • MD5

      38debb1ffd53d8c1c00a972d2c5e6676

    • SHA1

      8e6ed5bc7c0f07559f82f381cc9f8c8e5f5d9da8

    • SHA256

      72714927de74b97c524c5fa8bc1a0dec83f038dbbed80b93b5e6280ca1317f41

    • SHA512

      dd1132ac929030da10dfa3a1dd0005e5b33f1c6b2269c0256070fe618046dadcde5a9e5818bdbdaf108dde11217a08e7adfc4c7dd37d0e88ce6d6291a167ae3d

    • SSDEEP

      49152:JKgtpyoMSglFselNx/Uf3+O4/fL2MO5rgZznQeVa:NtpVglFBUGj2xGR7c

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks