General

  • Target

    fuckwindows.exe

  • Size

    1.2MB

  • Sample

    240801-zqw7eszhpd

  • MD5

    7bbf03a8110563760b4f917582065eff

  • SHA1

    7ccc7ba96720bd81a4a7ef59bd77c9dd49326653

  • SHA256

    6b3063c244e8e32cc39e8d8d267f865fb943afbb92196db04cc272a2c68aaad5

  • SHA512

    393644875afb67e88c4ee79e916bdeceb4bf4e188c1211f14a91626fbbd7f88f3c967aef84be86a8c455ea791c8ca2a51c619d49a343e66f341273037f5b7d7f

  • SSDEEP

    24576:oQnZkrl1PGVuyhd9tBDgYW9sVTHzw9ulgUTYqwQ4co+y8BrVRHKV9OuVGawkU5dY:PTYYD4Hw

Malware Config

Targets

    • Target

      fuckwindows.exe

    • Size

      1.2MB

    • MD5

      7bbf03a8110563760b4f917582065eff

    • SHA1

      7ccc7ba96720bd81a4a7ef59bd77c9dd49326653

    • SHA256

      6b3063c244e8e32cc39e8d8d267f865fb943afbb92196db04cc272a2c68aaad5

    • SHA512

      393644875afb67e88c4ee79e916bdeceb4bf4e188c1211f14a91626fbbd7f88f3c967aef84be86a8c455ea791c8ca2a51c619d49a343e66f341273037f5b7d7f

    • SSDEEP

      24576:oQnZkrl1PGVuyhd9tBDgYW9sVTHzw9ulgUTYqwQ4co+y8BrVRHKV9OuVGawkU5dY:PTYYD4Hw

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Possible privilege escalation attempt

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks