Overview

overview

10

Static

static

3

a54d6f2a69...dN.exe

windows7-x64

10

a54d6f2a69...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a54d6f2a690404b550b20eec5901a5ae9abe4613deaa0f90b742463f7ef0de4dN.exe

  • Size

    86KB

  • Sample

    241119-tx87nsyfrj

  • MD5

    b95afff75208f4c82180fc7cb026ffb0

  • SHA1

    1f3d55f3c93361461d60d8cc24faa4802658e319

  • SHA256

    a54d6f2a690404b550b20eec5901a5ae9abe4613deaa0f90b742463f7ef0de4d

  • SHA512

    f1e3dcfae25f3b2bb7b7778ee86e50578e7e793508f895910a93b1ce34e8d62c64fd5cd44e789ffd9aa16ead8f9e3e2f5bd6c7380bf44dbada605cc438db5309

  • SSDEEP

    1536:z1sMveb4lR0daHy9v7Zc86y9U4AFRfBW6End:ZDeb4T0daHy9DZc86yGUjnd

Score
10/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      a54d6f2a690404b550b20eec5901a5ae9abe4613deaa0f90b742463f7ef0de4dN.exe

    • Size

      86KB

    • MD5

      b95afff75208f4c82180fc7cb026ffb0

    • SHA1

      1f3d55f3c93361461d60d8cc24faa4802658e319

    • SHA256

      a54d6f2a690404b550b20eec5901a5ae9abe4613deaa0f90b742463f7ef0de4d

    • SHA512

      f1e3dcfae25f3b2bb7b7778ee86e50578e7e793508f895910a93b1ce34e8d62c64fd5cd44e789ffd9aa16ead8f9e3e2f5bd6c7380bf44dbada605cc438db5309

    • SSDEEP

      1536:z1sMveb4lR0daHy9v7Zc86y9U4AFRfBW6End:ZDeb4T0daHy9DZc86yGUjnd

    Score
    10/10
    discoveryevasionpersistence

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks