a64d2ce94175c8e25546f8c4d525a4137712a29b7c38c2cf953464fa86286e29 | Triage

Sharing

General

Target

MW3CheatBlocker.v1.2.exe
Size

11.5MB
Sample

240714-17qawaxdkb
MD5

0e3ec063a8917521673b28e4f089faf6
SHA1

d4150df0010b15985a04ae0607f8caacb8783313
SHA256

a64d2ce94175c8e25546f8c4d525a4137712a29b7c38c2cf953464fa86286e29
SHA512

934bd06b77fa93b73d3d098fe8387059b9483a81cdf4b6dfd0be5ac5b152af6888436b14cb67d87179a6e42899af4ce6f3ebb66739f228f0036debbdc1ceb366
SSDEEP

196608:DPDGAwgGiA2h3rjmk1IOrZsrc6Gzd+dCs9zKVMYniHF28q:jYgD3HzIYZyapstwMYil28

Score

8^/10

evasion execution persistence

Malware Config

Targets

- Target
  
  MW3CheatBlocker.v1.2.exe
- Size
  
  11.5MB
- MD5
  
  0e3ec063a8917521673b28e4f089faf6
- SHA1
  
  d4150df0010b15985a04ae0607f8caacb8783313
- SHA256
  
  a64d2ce94175c8e25546f8c4d525a4137712a29b7c38c2cf953464fa86286e29
- SHA512
  
  934bd06b77fa93b73d3d098fe8387059b9483a81cdf4b6dfd0be5ac5b152af6888436b14cb67d87179a6e42899af4ce6f3ebb66739f228f0036debbdc1ceb366
- SSDEEP
  
  196608:DPDGAwgGiA2h3rjmk1IOrZsrc6Gzd+dCs9zKVMYniHF28q:jYgD3HzIYZyapstwMYil28
Score

8^/10

evasion execution persistence
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Power Settings

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistence

behavioral2