General

  • Target

    Megamind..mov

  • Size

    400KB

  • Sample

    241111-vnl68asbqm

  • MD5

    e66aac2a0d9c403cb84fc12adfcb7818

  • SHA1

    12759f77544dc828392e1c9824ad972d59703f93

  • SHA256

    e20090a38225191790efce6852d0d8ce9fdad96f0b0be6afe6486921aa9826b3

  • SHA512

    c721e13a7a5c0bf105c6306c130ae865b411ae042290e356e9fd550e6029a05e06adb76ef85dc60748e2df29acce83fdbf66f004aa003d89f9d12d51ea9e05cd

  • SSDEEP

    12288:IZtF+Oli7vDNhKD5nmw83Hnt40Z3SLXSPYxF:EVWmDRkt4m3kiSF

Malware Config

Targets

    • Target

      Megamind..mov

    • Size

      400KB

    • MD5

      e66aac2a0d9c403cb84fc12adfcb7818

    • SHA1

      12759f77544dc828392e1c9824ad972d59703f93

    • SHA256

      e20090a38225191790efce6852d0d8ce9fdad96f0b0be6afe6486921aa9826b3

    • SHA512

      c721e13a7a5c0bf105c6306c130ae865b411ae042290e356e9fd550e6029a05e06adb76ef85dc60748e2df29acce83fdbf66f004aa003d89f9d12d51ea9e05cd

    • SSDEEP

      12288:IZtF+Oli7vDNhKD5nmw83Hnt40Z3SLXSPYxF:EVWmDRkt4m3kiSF

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Disables Task Manager via registry modification

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Event Triggered Execution: Image File Execution Options Injection

    • Sets service image path in registry

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

    • A potential corporate email address has been identified in the URL: 67C716D751E567F70A490D4C@AdobeOrg

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks