General

  • Target

    d65ea0a487b64a295e068eccd6c96b1165ff6381ed4734ce59b0ac0262b62c91N

  • Size

    384KB

  • Sample

    241109-xmv4vazeqe

  • MD5

    69b2517673d6c44c4e14b973f087d050

  • SHA1

    83737c025d7abb81959adb2940d11c6604d9a97a

  • SHA256

    d65ea0a487b64a295e068eccd6c96b1165ff6381ed4734ce59b0ac0262b62c91

  • SHA512

    595559c0acaf9f523fd35494ffb9149d5d73bf6a0cf93f14ca91cf3883a70faee704184401af932ab02edbdf7a838497dd6b7aec15646338808875421226591f

  • SSDEEP

    6144:V/OZplC/OZplP/OZplx/OZpl7/OZplx/OZpl4/OZplpBE/OZ8:V/MC/MP/Mx/M7/Mx/M4/MpBE/h

Malware Config

Targets

    • Target

      d65ea0a487b64a295e068eccd6c96b1165ff6381ed4734ce59b0ac0262b62c91N

    • Size

      384KB

    • MD5

      69b2517673d6c44c4e14b973f087d050

    • SHA1

      83737c025d7abb81959adb2940d11c6604d9a97a

    • SHA256

      d65ea0a487b64a295e068eccd6c96b1165ff6381ed4734ce59b0ac0262b62c91

    • SHA512

      595559c0acaf9f523fd35494ffb9149d5d73bf6a0cf93f14ca91cf3883a70faee704184401af932ab02edbdf7a838497dd6b7aec15646338808875421226591f

    • SSDEEP

      6144:V/OZplC/OZplP/OZplx/OZpl7/OZplx/OZpl4/OZplpBE/OZ8:V/MC/MP/Mx/M7/Mx/M4/MpBE/h

    • Modifies WinLogon for persistence

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Disables cmd.exe use via registry modification

    • Disables use of System Restore points

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks