General
-
Target
download-thank-you.php
-
Size
43KB
-
Sample
241016-x1skwa1epl
-
MD5
b914f50f24b693c93d1040e2bd07af00
-
SHA1
12e08f5e8882703c796b977a079a1ae2e35ede05
-
SHA256
5b96b8e0ff46adca9e7bcb5ee8a7bf6ea0e5f70dd0cafc2bc6cf6f13af9e7ab6
-
SHA512
f4539e13b6fb45d587ed78464669d9cbb612255b249a73d738f2d6f8b7ed96ea9d2aa3ba68c28f96a25941e48c56793f6fab02833cdeb147accb8840fdd9887f
-
SSDEEP
768:9APIvEA6WipgP40EnMKSIdhSf/qZSfq4Sfqh+DLZokpTdQG5LnvZfyQt9hvrOOHD:awvEA6WipgP40EnMKSIdhSf/qZSfq4Sl
Static task
static1
Behavioral task
behavioral1
Sample
download-thank-you.html
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
download-thank-you.php
-
Size
43KB
-
MD5
b914f50f24b693c93d1040e2bd07af00
-
SHA1
12e08f5e8882703c796b977a079a1ae2e35ede05
-
SHA256
5b96b8e0ff46adca9e7bcb5ee8a7bf6ea0e5f70dd0cafc2bc6cf6f13af9e7ab6
-
SHA512
f4539e13b6fb45d587ed78464669d9cbb612255b249a73d738f2d6f8b7ed96ea9d2aa3ba68c28f96a25941e48c56793f6fab02833cdeb147accb8840fdd9887f
-
SSDEEP
768:9APIvEA6WipgP40EnMKSIdhSf/qZSfq4Sfqh+DLZokpTdQG5LnvZfyQt9hvrOOHD:awvEA6WipgP40EnMKSIdhSf/qZSfq4Sl
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Event Triggered Execution: Image File Execution Options Injection
-
Sets service image path in registry
-
Uses Session Manager for persistence
Creates Session Manager registry key to run executable early in system boot.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
3Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
3Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
6Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
8Software Discovery
1Security Software Discovery
1System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1