General

  • Target

    getscreen.exe

  • Size

    4.1MB

  • Sample

    241111-hb77pstpbt

  • MD5

    f77ae924f3ae3e21e05925a766857262

  • SHA1

    e52df540e89a5d7a8e1f5fffb61c5d4ab4ee78fc

  • SHA256

    1a8cf93a82674d37fe66ad5f14d0b4341992a8fd215620eced9be6a6450fc05b

  • SHA512

    a5e186d2eddb4a80d50c561eac4a45760d0de7b791f6ef771e86c8796604fcda0af1a1a1c6ec29f9d4e3828c9e848a7b6326d972f7b6b67c9b19d353aed0a45b

  • SSDEEP

    98304:Zpd74oSMWA40m3f+fde5GsTUqo750vdl9ajIbt:7dknPALm3fB5i7pIJ

Malware Config

Targets

    • Target

      getscreen.exe

    • Size

      4.1MB

    • MD5

      f77ae924f3ae3e21e05925a766857262

    • SHA1

      e52df540e89a5d7a8e1f5fffb61c5d4ab4ee78fc

    • SHA256

      1a8cf93a82674d37fe66ad5f14d0b4341992a8fd215620eced9be6a6450fc05b

    • SHA512

      a5e186d2eddb4a80d50c561eac4a45760d0de7b791f6ef771e86c8796604fcda0af1a1a1c6ec29f9d4e3828c9e848a7b6326d972f7b6b67c9b19d353aed0a45b

    • SSDEEP

      98304:Zpd74oSMWA40m3f+fde5GsTUqo750vdl9ajIbt:7dknPALm3fB5i7pIJ

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • A potential corporate email address has been identified in the URL: [email protected]

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks