General

  • Target

    e6f0e9d26337ff6600219104f8b66b84084f5afddff14146b8b33c74f6cb25f5

  • Size

    759KB

  • Sample

    250703-gn1sqafm4v

  • MD5

    0e753de9982aec97dbf71f3dac8e5757

  • SHA1

    181c5b920606a198479928bb7d552eb7076a153c

  • SHA256

    e6f0e9d26337ff6600219104f8b66b84084f5afddff14146b8b33c74f6cb25f5

  • SHA512

    c309d1a76ad955913193f202c6b4f2ca47fc82f30af5dd37dc3871e51e537397306884e20f47700e852605ef89991d86cc69a02ee944daf31fdff3ff57e0217a

  • SSDEEP

    12288:Ip4pNfz3ymJnJ8QCFkxCaQTOlOM64hY8+5MtnKrIXn:iEtl9mRda1d+5KKg

Score
10/10

Malware Config

Targets

    • Target

      e6f0e9d26337ff6600219104f8b66b84084f5afddff14146b8b33c74f6cb25f5

    • Size

      759KB

    • MD5

      0e753de9982aec97dbf71f3dac8e5757

    • SHA1

      181c5b920606a198479928bb7d552eb7076a153c

    • SHA256

      e6f0e9d26337ff6600219104f8b66b84084f5afddff14146b8b33c74f6cb25f5

    • SHA512

      c309d1a76ad955913193f202c6b4f2ca47fc82f30af5dd37dc3871e51e537397306884e20f47700e852605ef89991d86cc69a02ee944daf31fdff3ff57e0217a

    • SSDEEP

      12288:Ip4pNfz3ymJnJ8QCFkxCaQTOlOM64hY8+5MtnKrIXn:iEtl9mRda1d+5KKg

    Score
    10/10
    • Modifies WinLogon for persistence

    • Drops startup file

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks