General
-
Target
image.webp
-
Size
152KB
-
Sample
241111-r2gbcatmdr
-
MD5
8f3c27c69754ff0bd59ca181032e37a6
-
SHA1
640e0fea3d865b137e456a62932ccd492b1ec2c1
-
SHA256
12f76120ad5a6e7685abaae14eeeb026049a9d4b43fd552506439d37a642cd18
-
SHA512
78566d0d79c6d5c2c4acea029701911fe5abe41d784ca6d49b17e6135b92dd1793ad274467a35e480c9b140d3c8e333675c40863b8f6a2fbf1b8c502e1241524
-
SSDEEP
3072:84vD/vweSmulvbXkvyZd5B/WGpe64zPe4a8OArpiXf4o1xMIFHjcH9bYvP/futb8:844mSvDkazXeVP6jmpiXf4oIOksfw8
Static task
static1
Behavioral task
behavioral1
Sample
image.webp
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
image.webp
-
Size
152KB
-
MD5
8f3c27c69754ff0bd59ca181032e37a6
-
SHA1
640e0fea3d865b137e456a62932ccd492b1ec2c1
-
SHA256
12f76120ad5a6e7685abaae14eeeb026049a9d4b43fd552506439d37a642cd18
-
SHA512
78566d0d79c6d5c2c4acea029701911fe5abe41d784ca6d49b17e6135b92dd1793ad274467a35e480c9b140d3c8e333675c40863b8f6a2fbf1b8c502e1241524
-
SSDEEP
3072:84vD/vweSmulvbXkvyZd5B/WGpe64zPe4a8OArpiXf4o1xMIFHjcH9bYvP/futb8:844mSvDkazXeVP6jmpiXf4oIOksfw8
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Contacts a large (503) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Event Triggered Execution: Image File Execution Options Injection
-
Sets service image path in registry
-
Uses Session Manager for persistence
Creates Session Manager registry key to run executable early in system boot.
-
A potential corporate email address has been identified in the URL: 0E920C0F53DA9E9B0A490D45@AdobeOrg
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
3Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
3Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
6Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Query Registry
7Software Discovery
1Security Software Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1