General

  • Target

    SPSSStatistics.exe

  • Size

    884.7MB

  • Sample

    241114-az4kessbmg

  • MD5

    ac1250aa57f0cadc8f60fd7a86d8ec03

  • SHA1

    f6ab396d2d665d399f6091227962d8919c93b898

  • SHA256

    84f052696739bb6b29681d595b118b5752cb6a162f9c2c6522af9a545fafc282

  • SHA512

    364f11434b67b6897232386057af9bbdf78e54b9630f5207be32f635ac0ae5848edaa199eb7d2c0a4a62393549a94826b54528b2cae5e7cb151e1d14d5e86c4c

  • SSDEEP

    25165824:RRHgLvVrxxqJRmyD1NhD/3DjIR5I87tvss:Lgb8RmO7PIjIUtv

Malware Config

Targets

    • Target

      SPSSStatistics.exe

    • Size

      884.7MB

    • MD5

      ac1250aa57f0cadc8f60fd7a86d8ec03

    • SHA1

      f6ab396d2d665d399f6091227962d8919c93b898

    • SHA256

      84f052696739bb6b29681d595b118b5752cb6a162f9c2c6522af9a545fafc282

    • SHA512

      364f11434b67b6897232386057af9bbdf78e54b9630f5207be32f635ac0ae5848edaa199eb7d2c0a4a62393549a94826b54528b2cae5e7cb151e1d14d5e86c4c

    • SSDEEP

      25165824:RRHgLvVrxxqJRmyD1NhD/3DjIR5I87tvss:Lgb8RmO7PIjIUtv

    • Adds Run key to start application

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Enumerates processes with tasklist

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

MITRE ATT&CK Enterprise v15

Tasks