General
-
Target
1084d7cc1615c8bfdd3d335e9434b192713158650b76f826310a84d9229b86e0N
-
Size
6.4MB
-
Sample
240920-tv5rgawara
-
MD5
1c337d70af9568152227490de5b472e0
-
SHA1
0f20da0c0528b8b86a2e9735de85c23350e03508
-
SHA256
1084d7cc1615c8bfdd3d335e9434b192713158650b76f826310a84d9229b86e0
-
SHA512
0f3afbba8c30018f94b0b32492f73b82c0ba7d6c6d63b58b7f663dd0034756f1c917652dadebd89abfad3b6b2f468b760626e662940bfda67cc0a9618311d4b2
-
SSDEEP
196608:91Ougx81Ma+RvIeSC04MFe3Aj0lz9oROcx7a9y:3Ovx+J+hI40402A0z9GHx7aE
Static task
static1
Behavioral task
behavioral1
Sample
1084d7cc1615c8bfdd3d335e9434b192713158650b76f826310a84d9229b86e0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1084d7cc1615c8bfdd3d335e9434b192713158650b76f826310a84d9229b86e0N.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
1084d7cc1615c8bfdd3d335e9434b192713158650b76f826310a84d9229b86e0N
-
Size
6.4MB
-
MD5
1c337d70af9568152227490de5b472e0
-
SHA1
0f20da0c0528b8b86a2e9735de85c23350e03508
-
SHA256
1084d7cc1615c8bfdd3d335e9434b192713158650b76f826310a84d9229b86e0
-
SHA512
0f3afbba8c30018f94b0b32492f73b82c0ba7d6c6d63b58b7f663dd0034756f1c917652dadebd89abfad3b6b2f468b760626e662940bfda67cc0a9618311d4b2
-
SSDEEP
196608:91Ougx81Ma+RvIeSC04MFe3Aj0lz9oROcx7a9y:3Ovx+J+hI40402A0z9GHx7aE
-
Blocklisted process makes network request
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Indirect Command Execution
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Indirect Command Execution
1Modify Registry
2