General
-
Target
Ghost Car.mp4
-
Size
775KB
-
Sample
241102-t7wz4azblh
-
MD5
acc26d93c10425eff0b720398067400e
-
SHA1
0329484bd3ba55f19b3c4e4d70b18349430f65b4
-
SHA256
3bbb8b357509008faaf484a0e0b5e26955ca21084a5947410b1d682cb7a64774
-
SHA512
05d27bd56d44e2df6f35c60cfe0eb462c54ccac959743ce581f0af05344fe61f1d0dc4d1c5592191bf4733fb8aa72e1b2f45e3f1282716786ed1998ec1a42e7c
-
SSDEEP
12288:5Z7+j8g4uOHHKaBJ7+TGet6CI9fU3P83Un0iIwgp6ajTNEEZrM2BTrRyLhXBBqkw:aT4VvhieU3PGi9hgp6at5ZILhXFw
Static task
static1
Behavioral task
behavioral1
Sample
Ghost Car.mp4
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
Ghost Car.mp4
-
Size
775KB
-
MD5
acc26d93c10425eff0b720398067400e
-
SHA1
0329484bd3ba55f19b3c4e4d70b18349430f65b4
-
SHA256
3bbb8b357509008faaf484a0e0b5e26955ca21084a5947410b1d682cb7a64774
-
SHA512
05d27bd56d44e2df6f35c60cfe0eb462c54ccac959743ce581f0af05344fe61f1d0dc4d1c5592191bf4733fb8aa72e1b2f45e3f1282716786ed1998ec1a42e7c
-
SSDEEP
12288:5Z7+j8g4uOHHKaBJ7+TGet6CI9fU3P83Un0iIwgp6ajTNEEZrM2BTrRyLhXBBqkw:aT4VvhieU3PGi9hgp6at5ZILhXFw
-
Modifies security service
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Modifies RDP port number used by Windows
-
Possible privilege escalation attempt
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Modifies file permissions
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
6