General

  • Target

    0b7abe9364fe4b737361ac6fac252b01803f80e5cfba2e6b86ddd10d4bad513eN

  • Size

    6.9MB

  • Sample

    241108-pfsfdascqr

  • MD5

    60d4ad7410c7603735fc389eea274030

  • SHA1

    6c72da182caf1cd3dc338c832fb0a34e9b9c8aa6

  • SHA256

    0b7abe9364fe4b737361ac6fac252b01803f80e5cfba2e6b86ddd10d4bad513e

  • SHA512

    90604546ab534a4ec636a86f0958c5a27e9b6f3322c32dc07e276c391bb0f1369f228fa6ef671a8ae1464357bf803b251074d9872fe097c3ce40b2c91d038e4c

  • SSDEEP

    196608:47effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXI1G8do8hFqyfz:47effIPEsy58doQaTxLhQyZbIly38doe

Malware Config

Targets

    • Target

      0b7abe9364fe4b737361ac6fac252b01803f80e5cfba2e6b86ddd10d4bad513eN

    • Size

      6.9MB

    • MD5

      60d4ad7410c7603735fc389eea274030

    • SHA1

      6c72da182caf1cd3dc338c832fb0a34e9b9c8aa6

    • SHA256

      0b7abe9364fe4b737361ac6fac252b01803f80e5cfba2e6b86ddd10d4bad513e

    • SHA512

      90604546ab534a4ec636a86f0958c5a27e9b6f3322c32dc07e276c391bb0f1369f228fa6ef671a8ae1464357bf803b251074d9872fe097c3ce40b2c91d038e4c

    • SSDEEP

      196608:47effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXI1G8do8hFqyfz:47effIPEsy58doQaTxLhQyZbIly38doe

    • Modifies WinLogon for persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks