General
-
Target
aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912
-
Size
38KB
-
Sample
241111-ck9h8stlal
-
MD5
51b4b6d3139c77d3bb6fe3b6bd7a3651
-
SHA1
3d75b85da0618a66719a590104692c652b4d91b1
-
SHA256
aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912
-
SHA512
602a25e4606bc0d3713461af8d82c6b276f072fb38467c24e05258aa487d43925e6b6e5d61eaf38aa9a34aaa84d33939ff1a8240269ee3e998a3c9ffc5369b00
-
SSDEEP
768:aHpqwkfEY6GmDvRwlNoJfiqFMkBh5e6BXZgB4e:aHpXkfhitgQiqFd5XZgCe
Behavioral task
behavioral1
Sample
aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe
Resource
win7-20241023-en
Malware Config
Targets
-
-
Target
aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912
-
Size
38KB
-
MD5
51b4b6d3139c77d3bb6fe3b6bd7a3651
-
SHA1
3d75b85da0618a66719a590104692c652b4d91b1
-
SHA256
aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912
-
SHA512
602a25e4606bc0d3713461af8d82c6b276f072fb38467c24e05258aa487d43925e6b6e5d61eaf38aa9a34aaa84d33939ff1a8240269ee3e998a3c9ffc5369b00
-
SSDEEP
768:aHpqwkfEY6GmDvRwlNoJfiqFMkBh5e6BXZgB4e:aHpXkfhitgQiqFd5XZgCe
-
Modifies firewall policy service
-
Drops file in Drivers directory
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Modifies WinLogon
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Browser Extensions
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1