General

  • Target

    f53131d88d34e46d656859cea34fa48d548ae7295c6d034daeecbf7160e18ab9

  • Size

    22KB

  • Sample

    241031-h1p3es1pey

  • MD5

    27542ec9deac08845db175f955c8a4ca

  • SHA1

    25e032ad9a6864395f16d935e557965eeb2ea360

  • SHA256

    f53131d88d34e46d656859cea34fa48d548ae7295c6d034daeecbf7160e18ab9

  • SHA512

    915cddf29f6f5daef22433498ab85856db36e25540ae9cbbde9a25a616781f2ccb262f64c9475cbd46629aba76b9c84e8344c36e546f13c9d31ccde3a131e906

  • SSDEEP

    384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvXfR4nsHCaJ97Oi:rRkiLw3HsDSARGG/Nim7

Malware Config

Targets

    • Target

      f53131d88d34e46d656859cea34fa48d548ae7295c6d034daeecbf7160e18ab9

    • Size

      22KB

    • MD5

      27542ec9deac08845db175f955c8a4ca

    • SHA1

      25e032ad9a6864395f16d935e557965eeb2ea360

    • SHA256

      f53131d88d34e46d656859cea34fa48d548ae7295c6d034daeecbf7160e18ab9

    • SHA512

      915cddf29f6f5daef22433498ab85856db36e25540ae9cbbde9a25a616781f2ccb262f64c9475cbd46629aba76b9c84e8344c36e546f13c9d31ccde3a131e906

    • SSDEEP

      384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvXfR4nsHCaJ97Oi:rRkiLw3HsDSARGG/Nim7

    • Windows security bypass

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops file in Drivers directory

    • Event Triggered Execution: Image File Execution Options Injection

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Indicator Removal: Clear Persistence

      remove IFEO.

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks