8283eea39bb977af03a560164cf1f165ce516e48b74cb27e1517de020c56521a

General

Target

getw7.exe
Size

208KB
Sample

240708-stbxbsvgmr
MD5

d424fe464b05746c6ab7bc7d9bd1fd7b
SHA1

1978f00747e528cccb46edf037110f2db69a991b
SHA256

8283eea39bb977af03a560164cf1f165ce516e48b74cb27e1517de020c56521a
SHA512

f8cdbf364444cd0d01e1c2b5d26b7f11aa35d248714b8f32d83fdfe7ebaf88495f281e46024ee82b86cd17603d6b02777a20f47408d8f42741939749c6d25b9c
SSDEEP

3072:Wfr3k+o5buDC1cub0AXj5iNyPpT4bG2akv4uFf2FNFhkvb0AXj5iNyPpT4bG2o4:WfY+on0AXjiU4bzx4uFfYyoAXjiU4bzL

Score

8^/10

Malware Config

Targets

- Target
  
  getw7.exe
- Size
  
  208KB
- MD5
  
  d424fe464b05746c6ab7bc7d9bd1fd7b
- SHA1
  
  1978f00747e528cccb46edf037110f2db69a991b
- SHA256
  
  8283eea39bb977af03a560164cf1f165ce516e48b74cb27e1517de020c56521a
- SHA512
  
  f8cdbf364444cd0d01e1c2b5d26b7f11aa35d248714b8f32d83fdfe7ebaf88495f281e46024ee82b86cd17603d6b02777a20f47408d8f42741939749c6d25b9c
- SSDEEP
  
  3072:Wfr3k+o5buDC1cub0AXj5iNyPpT4bG2akv4uFf2FNFhkvb0AXj5iNyPpT4bG2o4:WfY+on0AXjiU4bzx4uFfYyoAXjiU4bzL
Score

8^/10

defense_evasion discovery evasion execution exploit persistence privilege_escalation
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
behavioral1