Resubmissions

31/10/2024, 15:23

241031-ssm8zaypbs 6

31/10/2024, 15:20

241031-sqztzs1cpq 4

31/10/2024, 13:47

241031-q3rm2axpe1 8

31/10/2024, 13:26

241031-qp1zjsxmhx 6

General

  • Target

    winrar-64-7.01-installer_pC-OmB1.exe

  • Size

    1.7MB

  • Sample

    241031-qp1zjsxmhx

  • MD5

    144d86ea0612c661cdae6bfbd56c3ee4

  • SHA1

    cf4b216d24cafdc9479c1047d73120991b22024a

  • SHA256

    820e8dd4d66068c0e69f29f025f4a1ae55a4730d2b33c936eef36b639f66707c

  • SHA512

    d3369c3319d66350bc738aaab7793946a9f7db96b5d64ecd656f5af85dbe36f5ee26f5e5e3bde6f4a63b0b62a95b38ef14951301c73c7305023fc631c1d8395c

  • SSDEEP

    24576:j7FUDowAyrTVE3U5F/VVc4p78tMhAx9G4CUHYALjAtpKuuSGVk9KjCUBjSG:jBuZrEU7h7qxsPERVk9ybl

Malware Config

Targets

    • Target

      winrar-64-7.01-installer_pC-OmB1.exe

    • Size

      1.7MB

    • MD5

      144d86ea0612c661cdae6bfbd56c3ee4

    • SHA1

      cf4b216d24cafdc9479c1047d73120991b22024a

    • SHA256

      820e8dd4d66068c0e69f29f025f4a1ae55a4730d2b33c936eef36b639f66707c

    • SHA512

      d3369c3319d66350bc738aaab7793946a9f7db96b5d64ecd656f5af85dbe36f5ee26f5e5e3bde6f4a63b0b62a95b38ef14951301c73c7305023fc631c1d8395c

    • SSDEEP

      24576:j7FUDowAyrTVE3U5F/VVc4p78tMhAx9G4CUHYALjAtpKuuSGVk9KjCUBjSG:jBuZrEU7h7qxsPERVk9ybl

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Event Triggered Execution: Image File Execution Options Injection

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

MITRE ATT&CK Enterprise v15

Tasks