General
-
Target
SPSSStatistics.exe
-
Size
884.7MB
-
Sample
241114-az4kessbmg
-
MD5
ac1250aa57f0cadc8f60fd7a86d8ec03
-
SHA1
f6ab396d2d665d399f6091227962d8919c93b898
-
SHA256
84f052696739bb6b29681d595b118b5752cb6a162f9c2c6522af9a545fafc282
-
SHA512
364f11434b67b6897232386057af9bbdf78e54b9630f5207be32f635ac0ae5848edaa199eb7d2c0a4a62393549a94826b54528b2cae5e7cb151e1d14d5e86c4c
-
SSDEEP
25165824:RRHgLvVrxxqJRmyD1NhD/3DjIR5I87tvss:Lgb8RmO7PIjIUtv
Static task
static1
Behavioral task
behavioral1
Sample
SPSSStatistics.exe
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
SPSSStatistics.exe
-
Size
884.7MB
-
MD5
ac1250aa57f0cadc8f60fd7a86d8ec03
-
SHA1
f6ab396d2d665d399f6091227962d8919c93b898
-
SHA256
84f052696739bb6b29681d595b118b5752cb6a162f9c2c6522af9a545fafc282
-
SHA512
364f11434b67b6897232386057af9bbdf78e54b9630f5207be32f635ac0ae5848edaa199eb7d2c0a4a62393549a94826b54528b2cae5e7cb151e1d14d5e86c4c
-
SSDEEP
25165824:RRHgLvVrxxqJRmyD1NhD/3DjIR5I87tvss:Lgb8RmO7PIjIUtv
-
Adds Run key to start application
-
Blocklisted process makes network request
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates processes with tasklist
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1