General
-
Target
1dolar....png
-
Size
434KB
-
Sample
250118-2p7ymsxlh1
-
MD5
c987f89cfb71ab62b207d9db7f9e2215
-
SHA1
7f3d80d21105e4b1121f450c631433f8b89bc999
-
SHA256
00a9607440ef0b169a4c3908a204af9dc3a202c8788dab74621e41e2881697b9
-
SHA512
1148524e018582c7c3cdc716b3ce25a913312cc32ac60451aafe4ecc5598dcf88cc495b364f68c24df44875df936a55c28c1493c37c51dc2f951fbefd04956b1
-
SSDEEP
12288:0OlDZpFgBN4ybmhP4gtCOwCtScLDkdAI7uyLt:VlF/4NvY7tggYmI7VR
Static task
static1
Behavioral task
behavioral1
Sample
1dolar....png
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
1dolar....png
-
Size
434KB
-
MD5
c987f89cfb71ab62b207d9db7f9e2215
-
SHA1
7f3d80d21105e4b1121f450c631433f8b89bc999
-
SHA256
00a9607440ef0b169a4c3908a204af9dc3a202c8788dab74621e41e2881697b9
-
SHA512
1148524e018582c7c3cdc716b3ce25a913312cc32ac60451aafe4ecc5598dcf88cc495b364f68c24df44875df936a55c28c1493c37c51dc2f951fbefd04956b1
-
SSDEEP
12288:0OlDZpFgBN4ybmhP4gtCOwCtScLDkdAI7uyLt:VlF/4NvY7tggYmI7VR
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
5Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
3Install Root Certificate
1SIP and Trust Provider Hijacking
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
6Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1