General

  • Target

    c5f031c06ef95607505c7f0940f5f401ce45e93b5d003843d1ee0d9ee6b38959

  • Size

    7.3MB

  • Sample

    240801-2rwnds1ajn

  • MD5

    229cea6f5b06c28fb63c9057ac31a256

  • SHA1

    7689b1ad09b5cf9f24de238a72c5d590e8193bc9

  • SHA256

    c5f031c06ef95607505c7f0940f5f401ce45e93b5d003843d1ee0d9ee6b38959

  • SHA512

    2371e82db78a0f41f5ac08781fff42ae5109a214929b5e216db0426fc31f2b7b26399ee02c7ac8555121fb51fff713943928c35893581cbf69fe8b8d0b53c336

  • SSDEEP

    196608:91OZK9Lufgodr+GoEHYy8swGDKoRwNz10rlIuSU+Yot0E:3OZgLkXdKGRYy4om16GU4v

Malware Config

Targets

    • Target

      c5f031c06ef95607505c7f0940f5f401ce45e93b5d003843d1ee0d9ee6b38959

    • Size

      7.3MB

    • MD5

      229cea6f5b06c28fb63c9057ac31a256

    • SHA1

      7689b1ad09b5cf9f24de238a72c5d590e8193bc9

    • SHA256

      c5f031c06ef95607505c7f0940f5f401ce45e93b5d003843d1ee0d9ee6b38959

    • SHA512

      2371e82db78a0f41f5ac08781fff42ae5109a214929b5e216db0426fc31f2b7b26399ee02c7ac8555121fb51fff713943928c35893581cbf69fe8b8d0b53c336

    • SSDEEP

      196608:91OZK9Lufgodr+GoEHYy8swGDKoRwNz10rlIuSU+Yot0E:3OZgLkXdKGRYy4om16GU4v

    • Modifies Windows Defender Real-time Protection settings

    • Windows security bypass

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Indirect Command Execution

      Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops Chrome extension

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.