General

  • Target

    8bed79feb6e2d9a28e9384dd29ca760b272ec92b648d1f274498423be3a0b610

  • Size

    765KB

  • Sample

    250703-glfprsfl7y

  • MD5

    01bafd5d4488da7a2487420e770d76fe

  • SHA1

    2f30a2c82b9fa0065e2de2cd2c1e26401f2d9187

  • SHA256

    8bed79feb6e2d9a28e9384dd29ca760b272ec92b648d1f274498423be3a0b610

  • SHA512

    06d92ad33cd80e5dd87c4eb7965d422d7dba599e4f16d6a75e9d04ed8ff794dd127d6f52da61bbc0b01e7fe4c4bc960c15223dcd7b2b5c98fa8d5e7cb8439d31

  • SSDEEP

    12288:Ip4pNfz3ymJnJ8QCFkxCaQTOlOM64nc0fYh+lgsL9Jj7q9nWFhVoOU3FmU9AdZiC:iEtl9mRda1TJ7bZUr3vKLOo

Score
10/10

Malware Config

Targets

    • Target

      8bed79feb6e2d9a28e9384dd29ca760b272ec92b648d1f274498423be3a0b610

    • Size

      765KB

    • MD5

      01bafd5d4488da7a2487420e770d76fe

    • SHA1

      2f30a2c82b9fa0065e2de2cd2c1e26401f2d9187

    • SHA256

      8bed79feb6e2d9a28e9384dd29ca760b272ec92b648d1f274498423be3a0b610

    • SHA512

      06d92ad33cd80e5dd87c4eb7965d422d7dba599e4f16d6a75e9d04ed8ff794dd127d6f52da61bbc0b01e7fe4c4bc960c15223dcd7b2b5c98fa8d5e7cb8439d31

    • SSDEEP

      12288:Ip4pNfz3ymJnJ8QCFkxCaQTOlOM64nc0fYh+lgsL9Jj7q9nWFhVoOU3FmU9AdZiC:iEtl9mRda1TJ7bZUr3vKLOo

    Score
    10/10
    • Modifies WinLogon for persistence

    • Drops startup file

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks