General
-
Target
dd1b7d71e06f6fe0ff42fec55e5998adb5072786367436f30192f04344f17e12N
-
Size
35KB
-
Sample
241107-nkrh7s1jb1
-
MD5
72c7c0a1b98ed07b1f513bfd24ae74e0
-
SHA1
0a7e03ee7b4cfee1e858535800174ffbf963c01a
-
SHA256
dd1b7d71e06f6fe0ff42fec55e5998adb5072786367436f30192f04344f17e12
-
SHA512
f565c4eedaefea2390c2b353da615fcb4446f2e8ad47dae5e1d047b7bf0f3f13737928b45ab122904691e7faa2cba5133dc71b10f4f58ae447bee1bf45a7bd74
-
SSDEEP
768:UEzNbLcQ9qQuVriDMuyuruTD0qB77777J77c77c77c7nOTQ9Nu7jDwy:l3h9qQA6hZunrB77777J77c77c77c7ON
Behavioral task
behavioral1
Sample
dd1b7d71e06f6fe0ff42fec55e5998adb5072786367436f30192f04344f17e12N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd1b7d71e06f6fe0ff42fec55e5998adb5072786367436f30192f04344f17e12N.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
dd1b7d71e06f6fe0ff42fec55e5998adb5072786367436f30192f04344f17e12N
-
Size
35KB
-
MD5
72c7c0a1b98ed07b1f513bfd24ae74e0
-
SHA1
0a7e03ee7b4cfee1e858535800174ffbf963c01a
-
SHA256
dd1b7d71e06f6fe0ff42fec55e5998adb5072786367436f30192f04344f17e12
-
SHA512
f565c4eedaefea2390c2b353da615fcb4446f2e8ad47dae5e1d047b7bf0f3f13737928b45ab122904691e7faa2cba5133dc71b10f4f58ae447bee1bf45a7bd74
-
SSDEEP
768:UEzNbLcQ9qQuVriDMuyuruTD0qB77777J77c77c77c7nOTQ9Nu7jDwy:l3h9qQA6hZunrB77777J77c77c77c7ON
Score10/10-
Modifies WinLogon for persistence
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1