General

  • Target

    a9d686ae287b5d8f00ecfbd550dd4a4d59f3a75f8f2b6a4eb8954b8bfaa3482a

  • Size

    736KB

  • Sample

    250703-f699fahq6z

  • MD5

    b29eeb0f3d38b0234a4db465e6f1ba50

  • SHA1

    4da9148945c261a94463cb1a35b42448ca4e5823

  • SHA256

    a9d686ae287b5d8f00ecfbd550dd4a4d59f3a75f8f2b6a4eb8954b8bfaa3482a

  • SHA512

    cb19a88777f7b2cae87b942932b74af66e53e884c3bff790c4a5ffb7d267b783b6639567c139a61111967c86acac7e8f1991f41f9c96942b66bd8333e256ccc1

  • SSDEEP

    12288:Ip4pNfz3ymJnJ8QCFkxCaQTOlOM64mvtqM3Qcn6EUdM:iEtl9mRda1SQ1fK

Score
10/10

Malware Config

Targets

    • Target

      a9d686ae287b5d8f00ecfbd550dd4a4d59f3a75f8f2b6a4eb8954b8bfaa3482a

    • Size

      736KB

    • MD5

      b29eeb0f3d38b0234a4db465e6f1ba50

    • SHA1

      4da9148945c261a94463cb1a35b42448ca4e5823

    • SHA256

      a9d686ae287b5d8f00ecfbd550dd4a4d59f3a75f8f2b6a4eb8954b8bfaa3482a

    • SHA512

      cb19a88777f7b2cae87b942932b74af66e53e884c3bff790c4a5ffb7d267b783b6639567c139a61111967c86acac7e8f1991f41f9c96942b66bd8333e256ccc1

    • SSDEEP

      12288:Ip4pNfz3ymJnJ8QCFkxCaQTOlOM64mvtqM3Qcn6EUdM:iEtl9mRda1SQ1fK

    Score
    10/10
    • Modifies WinLogon for persistence

    • Drops startup file

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks