76eee256f1223082e8396611baca498542c656edd0fac5fe903e06e6cb5677e2 | Triage

Resubmissions

05/07/2024, 11:50

240705-nztxwazglg 8

05/07/2024, 11:46

240705-nxsl2axfmr 8

Sharing

General

Target

Vega X Windows_17922204.exe
Size

9.5MB
Sample

240705-nxsl2axfmr
MD5

3d50042e3e3991be509f56a2951a2183
SHA1

f027790afe9d7ce2ddf17973f0778fb9e983ded1
SHA256

76eee256f1223082e8396611baca498542c656edd0fac5fe903e06e6cb5677e2
SHA512

120c6a7778bd9f65f469d3335987b780e736bd895ed944d0988372f891b48f9ba09b50ed9dcffd0bf1fa23a12e215ed1f1ffe75d11c925ff4c08d3e48259a873
SSDEEP

196608:xoEToOU9+86NdnrqNnHmQ3bKfIiaNPFHNRsiK:xLTtU/QxrqNHL3bIIiEHMn

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Targets

- Target
  
  Vega X Windows_17922204.exe
- Size
  
  9.5MB
- MD5
  
  3d50042e3e3991be509f56a2951a2183
- SHA1
  
  f027790afe9d7ce2ddf17973f0778fb9e983ded1
- SHA256
  
  76eee256f1223082e8396611baca498542c656edd0fac5fe903e06e6cb5677e2
- SHA512
  
  120c6a7778bd9f65f469d3335987b780e736bd895ed944d0988372f891b48f9ba09b50ed9dcffd0bf1fa23a12e215ed1f1ffe75d11c925ff4c08d3e48259a873
- SSDEEP
  
  196608:xoEToOU9+86NdnrqNnHmQ3bKfIiaNPFHNRsiK:xLTtU/QxrqNHL3bIIiEHMn
Score

8^/10

discovery execution persistence privilege_escalation
- Creates new service(s)
  persistence execution
- Checks for any installed AV software in registry
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Process Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecutionpersistenceprivilege_escalation