General
-
Target
64ff25b32822831f2895affcf688bbe20df702262ec9804ab5e5a2708701b2f7N
-
Size
93KB
-
Sample
240920-j7caksxcrr
-
MD5
e138662aafdf34c8bfe2509ffbc83290
-
SHA1
88429a9e7855eb4994e1ef6bfe7c36b45125010a
-
SHA256
64ff25b32822831f2895affcf688bbe20df702262ec9804ab5e5a2708701b2f7
-
SHA512
14de8c5500538e52b25ac8c94e6b15753b21caa9b104d14765527495d9ff1e3469935fc7599e3d9123d8e3a7928b8e412f986a180e012b0397679e98f68f890b
-
SSDEEP
1536:4R3/jxT2CBouB39mz3jM9XdQZZuJ46NumWUk4HsDfFTVfGrFrAfXknnouy8:Wj8CBdp9mHM9iZMJvAmWX4HsDfFRfGr1
Malware Config
Targets
-
-
Target
64ff25b32822831f2895affcf688bbe20df702262ec9804ab5e5a2708701b2f7N
-
Size
93KB
-
MD5
e138662aafdf34c8bfe2509ffbc83290
-
SHA1
88429a9e7855eb4994e1ef6bfe7c36b45125010a
-
SHA256
64ff25b32822831f2895affcf688bbe20df702262ec9804ab5e5a2708701b2f7
-
SHA512
14de8c5500538e52b25ac8c94e6b15753b21caa9b104d14765527495d9ff1e3469935fc7599e3d9123d8e3a7928b8e412f986a180e012b0397679e98f68f890b
-
SSDEEP
1536:4R3/jxT2CBouB39mz3jM9XdQZZuJ46NumWUk4HsDfFTVfGrFrAfXknnouy8:Wj8CBdp9mHM9iZMJvAmWX4HsDfFRfGr1
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1