Overview

overview

8

Static

static

1

af0c898ab0...76.exe

windows7-x64

8

af0c898ab0...76.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    af0c898ab09223b4adb394e52928c835d144106ea382dd21418ae707687e4f76.exe

  • Size

    5.2MB

  • Sample

    240814-eag3cawdma

  • MD5

    d2bf6ee093cc79af013f7c638b5a7563

  • SHA1

    581c7b6afb7727e68494dc2011676351494fb376

  • SHA256

    af0c898ab09223b4adb394e52928c835d144106ea382dd21418ae707687e4f76

  • SHA512

    6401eb6c4f32e51d3c1fd77b7c60023ba9497c2f10d167a8d13259b775476b594df82cdd214e67814821cd5e71620ed9e6c2aefe1f28317d9bf8dc9bd3f5cef4

  • SSDEEP

    98304:vps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:RfefPJws3V+a

Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      af0c898ab09223b4adb394e52928c835d144106ea382dd21418ae707687e4f76.exe

    • Size

      5.2MB

    • MD5

      d2bf6ee093cc79af013f7c638b5a7563

    • SHA1

      581c7b6afb7727e68494dc2011676351494fb376

    • SHA256

      af0c898ab09223b4adb394e52928c835d144106ea382dd21418ae707687e4f76

    • SHA512

      6401eb6c4f32e51d3c1fd77b7c60023ba9497c2f10d167a8d13259b775476b594df82cdd214e67814821cd5e71620ed9e6c2aefe1f28317d9bf8dc9bd3f5cef4

    • SSDEEP

      98304:vps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:RfefPJws3V+a

    Score
    8/10
    discoverypersistenceprivilege_escalation

    • Sets service image path in registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks