Overview

overview

10

Static

static

1

ckJTQEOKC_...zip.7z

windows7-x64

1

ckJTQEOKC_...zip.7z

windows10-2004-x64

10

ckJTQEOKC_...24.zip

windows7-x64

1

ckJTQEOKC_...24.zip

windows10-2004-x64

1

ckJTQEOKC\...ge.log

windows7-x64

1

ckJTQEOKC\...ge.log

windows10-2004-x64

1

ckJTQEOKC\...ge.log

windows7-x64

1

ckJTQEOKC\...ge.log

windows10-2004-x64

1

ckJTQEOKC\...PH.vbs

windows7-x64

1

ckJTQEOKC\...PH.vbs

windows10-2004-x64

1

ckJTQEOKC\...PH.ps1

windows7-x64

10

ckJTQEOKC\...PH.ps1

windows10-2004-x64

10

ckJTQEOKC\darm.chh

windows7-x64

3

ckJTQEOKC\darm.chh

windows10-2004-x64

3

ckJTQEOKC\lite.chh

windows7-x64

3

ckJTQEOKC\lite.chh

windows10-2004-x64

3

ckJTQEOKC\msedge.log

windows7-x64

1

ckJTQEOKC\msedge.log

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ckJTQEOKC_28_11_2024.zip.7z

  • Size

    27KB

  • Sample

    241128-1ac92s1mf1

  • MD5

    28392dc4be3ecbc57953c605981affdc

  • SHA1

    fa897706e7e4ade0d35a3e2f6d0637c897fef777

  • SHA256

    2da77359f85bbc09c5ea5a4dd2f768e16079bbff9ae22a7cf84e4411bd65d1cb

  • SHA512

    e519bff9d5f41e519dba9e0d31dbc020f0b61b2157533becf8ee0508577a31f8fa6075e7f7d41566346751578a7a32967a62ad166da9cf47c1383bd943cc2a69

  • SSDEEP

    768:wqRsZXvxy2Wwbmqd1hBv4yUevPXp+9NaP996:wqRs5FWwbmq3bZPXp+9N

Score
10/10
discoverydropperexecution

Malware Config

Targets

    • Target

      ckJTQEOKC_28_11_2024.zip.7z

    • Size

      27KB

    • MD5

      28392dc4be3ecbc57953c605981affdc

    • SHA1

      fa897706e7e4ade0d35a3e2f6d0637c897fef777

    • SHA256

      2da77359f85bbc09c5ea5a4dd2f768e16079bbff9ae22a7cf84e4411bd65d1cb

    • SHA512

      e519bff9d5f41e519dba9e0d31dbc020f0b61b2157533becf8ee0508577a31f8fa6075e7f7d41566346751578a7a32967a62ad166da9cf47c1383bd943cc2a69

    • SSDEEP

      768:wqRsZXvxy2Wwbmqd1hBv4yUevPXp+9NaP996:wqRs5FWwbmq3bZPXp+9N

    Score
    10/10
    dropperexecution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Download via BitsAdmin

      dropper

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral1behavioral2

    • Target

      ckJTQEOKC_28_11_2024.zip

    • Size

      27KB

    • MD5

      89e609b8ca7227e0ab53f7ffbdfd20ae

    • SHA1

      e3956746bdced69dc646836652ebb8f1205e479b

    • SHA256

      3a02267af5a144ecff279c5b5d7a87e77a1ee5b51edae5464eb05f433c8870b6

    • SHA512

      4a793d3d6e230f74d2b0f3495fc820f69e9330de29eaa7899e1122fed4088dab46a897b539774aa2a81164fc601976334cac6ca0f4bab83cdb7042461de7bd98

    • SSDEEP

      768:YSHnVuzQL376GZqUOdmYyu6/xLpYOwcDi2mfXm:YSHnVuzQ7lqUOiu6/xL7wcDi/W

    Score
    1/10
    behavioral3behavioral4

    • Target

      ckJTQEOKC\0_msedge.log

    • Size

      32B

    • MD5

      fb2d4b4538f231805a677bf1fdae7618

    • SHA1

      9af3e31cad8f69e7d61f81005f8d7bb615ceea05

    • SHA256

      07bd6fa0bfb02d25cb31d8d9bb31653912671394c0fb1e8b10296682448627f2

    • SHA512

      d2fecf45f070e5cd752afdc6b229ffe6027ee12c726e98cc867ceb19990f964cd084de24312530c9d65a9b7ad7ad51d3d9a82c444d56a5a8cb78d65a636b6f05

    Score
    1/10
    behavioral5behavioral6

    • Target

      ckJTQEOKC\1_msedge.log

    • Size

      32B

    • MD5

      c5f79e50e9f1426aed3a210a3a5e8c4d

    • SHA1

      7c8dfd39f669d241205219f066a022e028749d8e

    • SHA256

      89e9165ac6d056ca646a831e17d0c0f8877a7ebc9adba1665be6a6b60d9636aa

    • SHA512

      20ac36e6a588077a038c894ebc0bd53966210b94706674e8ebc5e852463123c7f6a1255769949c29e70e4c75d179af3dfc77501cd5c7c3d6fbf0d92453074d41

    Score
    1/10
    behavioral7behavioral8

    • Target

      ckJTQEOKC\WdxzhJPH.lite

    • Size

      876B

    • MD5

      fd4e455ea3f14f99f5f9b66b4e0ef6d9

    • SHA1

      001bf670b7c829cb9d0ffb82a13ff2a65b1cb969

    • SHA256

      1cc49c3a3e3d7af8deea30253f7f0b2486b6de8f51c7ab1b420b22f5918005fc

    • SHA512

      f9b228ce9358013b92db3803fc6c81d7badf3917d7814d36ee43885b548558c1fbb3e4658d6f2ce752331d51d79898060071d475617810b3103eec8f85320d3b

    Score
    1/10
    behavioral10behavioral9

    • Target

      ckJTQEOKC\WdxzhJPH.ps1

    • Size

      2KB

    • MD5

      9d6d8a084805bbf5d22507780d14e8f4

    • SHA1

      27ebc6c5948855d6b5a7f1c5422a3be6a4a1e77a

    • SHA256

      9092a282a5c56c0a19713fd3067b528efae5b27e9faa737c87a9bbf6a566cc5e

    • SHA512

      a8142d16469fb415ad3f9212d52f0aadde797876e7735f3faebd79b57acd04688726e83047c808851ea9394b14dca0dad8c33a1e7695c4ce2a768d46a2f3597b

    Score
    10/10
    dropperexecution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Download via BitsAdmin

      dropper
    behavioral11behavioral12

    • Target

      ckJTQEOKC\darm.chh

    • Size

      1KB

    • MD5

      6b831ce8380c693ee6070ad424c9f92b

    • SHA1

      b87e2ef196383c246b996c4764e328d523b5c5b7

    • SHA256

      a65d23c0df6c750741bb63dee3564ea44462a07050f54a3b585d2c0c4b943e35

    • SHA512

      d333149446bd5e83310037b293b1cd73d3a2a15fa9b10ccbcda5fcac70b67e53e86aea4b7c7e0f567106ba3ca45c9856ccc69db7fd75b2d272397e92abf503e4

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      ckJTQEOKC\lite.chh

    • Size

      95KB

    • MD5

      960716f6d0c819d551f68b970faff1f9

    • SHA1

      f23ca0bafec43bd8ba899190d290ab9db97b7b07

    • SHA256

      a83be5df3bb0b2b83a3727b50d0ebd74b8d0ef425a29f1352095260e12569192

    • SHA512

      50fc39e4a1d3cb91ebc76dfe1eaf5f32fb4871957d57d67c0bbde29dd0f97412f945db442a4f95b3b7f69f1148fe68df7f76621493ad64f742052b333fbe5f25

    • SSDEEP

      1536:s6+jiQpDoJH1YaijGdZbXK5zn+5T3j3X3tvudjk6kMGqKo2Ia4+:L

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      ckJTQEOKC\msedge.log

    • Size

      16B

    • MD5

      49fa9b3510c1cbf6d6df2f4a2f9f8e65

    • SHA1

      3c1c22697e4370100ef87a52084d7c14fbf657d3

    • SHA256

      fcbccd7b328d9270a0f3820ecf622f6e14c09df6061f2275cb9524673b681acf

    • SHA512

      8870d64fb90035f6a8735c1bc8452ef516fd26de8472bdd4fc2e8d23a1a4b65566e954b1e3711a460ece543325389a487fdfc5ac477af8617b658e930ffd721f

    Score
    1/10
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks