7a2076347f976300ea89f1a7a955795498fb4653514b8e4c5f07336849455aa9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

MW3ChairBlocker2023.exe
Size

11.6MB
Sample

240821-1kfg6awbnq
MD5

25b96b0ddaefedc93ef56d14ecba0530
SHA1

1bcbd67d6b9d62900bd4467ab37e7c7bb82a0233
SHA256

7a2076347f976300ea89f1a7a955795498fb4653514b8e4c5f07336849455aa9
SHA512

4ed9d585b38fb9d4a18e345e2a8a9b137146714c5dcc2fb0fe9b784c69504bdb3081cf51a6404e3be2bb705ac7aedd9856242add75ff9144bd5fa4f619245c31
SSDEEP

196608:EXVcXF8UV07oJAGhoGMOfy9ZDlut/6k1L7Hn8doecEB+0Re6WCQsBp4pWvDgbhiP:EVG6UJAGhojat/H1L7Hnbe9By6DLRgbP

Score

8^/10

discovery evasion execution persistence

Malware Config

Targets

- Target
  
  MW3ChairBlocker2023.exe
- Size
  
  11.6MB
- MD5
  
  25b96b0ddaefedc93ef56d14ecba0530
- SHA1
  
  1bcbd67d6b9d62900bd4467ab37e7c7bb82a0233
- SHA256
  
  7a2076347f976300ea89f1a7a955795498fb4653514b8e4c5f07336849455aa9
- SHA512
  
  4ed9d585b38fb9d4a18e345e2a8a9b137146714c5dcc2fb0fe9b784c69504bdb3081cf51a6404e3be2bb705ac7aedd9856242add75ff9144bd5fa4f619245c31
- SSDEEP
  
  196608:EXVcXF8UV07oJAGhoGMOfy9ZDlut/6k1L7Hn8doecEB+0Re6WCQsBp4pWvDgbhiP:EVG6UJAGhojat/H1L7Hnbe9By6DLRgbP
Score

8^/10

discovery evasion execution persistence
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Power Settings

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexecutionpersistence

behavioral2