General
- Target vm1.exe
- Size 67.4MB
- Sample260523-mbkhvsav7x
- SHA256 729888fcb020c55e3f152d253df200d2fa22e02973a3f50931fed95b5a20938c
Malware Config
Targets
-
- Target vm1.exe
- Size 67.4MB
- SHA256 729888fcb020c55e3f152d253df200d2fa22e02973a3f50931fed95b5a20938c
Score4/10 -
- Target 001.exe
- Size 501KB
- SHA256 ec2ae1fb4b42a33ccc6180c03b11f038c715888c1d74d7d3df29521ff60c8d65
Score10/10Modifies WinLogon for persistence
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Modifies file permissions
Drops file in System32 directory
-
- Target 0b02.exe
- Size 19KB
- SHA256 a3f87c63250416c75cfc0a82c40d5814f671cd0ddbc2634e71792f9c279af477
Score1/10 -
- Target 0x07.exe
- Size 247KB
- SHA256 52d6d769eb474d4138ac31e05634a6ca7a4ebef5920f8356c1cd70d9fa42c2fb
Score8/10Drops file in Drivers directory
Possible privilege escalation attempt
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Modifies file permissions
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Modifies boot configuration data using bcdedit
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target 1lh9zfg5gl.exe
- Size 130KB
- SHA256 de6edce77707da0b9da874b9a5e4775f2b91e2bc39db05ee90091ac03c0360a6
Score1/10 -
- Target 2 EURO.exe
- Size 17.9MB
- SHA256 89c234a7920d7e3ef70803f66162876532772624917bb45d19e8d44a48b40831
Score6/10Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target 2,3,7,8-Tetrachlorodibenzodioxin-alpha.exe
- Size 495KB
- SHA256 f729dd2a305fffb3cb6e0a49343a07c8f5360b70f389af5438c929065929f6b2
Score3/10 -
- Target 2,3,7,8-Tetrachlorodibenzodioxin-safety.exe
- Size 512KB
- SHA256 3a0483c8caef931aa417ade2ead511a545560993fa4027e910208d2b8c0924f6
Score3/10 -
- Target 2,3,7,8-Tetrachlorodibenzodioxin.exe
- Size 553KB
- SHA256 447b5760863694ffaa9e6a32eb365f8313573faa5bef285d7dac1ee805a02031
Score8/10Disables Task Manager via registry modification
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target 2578.exe
- Size 235KB
- SHA256 52d30f7d4a94e3d7a12518c27c345ad58d02f77b27bf3c2e788bd0a7f076fe40
Score8/10Disables Task Manager via registry modification
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target 2578.safety.exe
- Size 234KB
- SHA256 4606a20fe316eece94d4af961bd32e8137c82cde18cb78fe3fb2380fd1888973
Score3/10 -
- Target 2MASS J07225830-2546030.exe
- Size 165KB
- SHA256 b2d5540346a4209f08972cea5a0c0544082290d5a97166d26dc28b01a820b93c
Score8/10Disables Task Manager via registry modification
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Modifies system executable filetype association
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target 2MASS J07225830-2546030.harmless.exe
- Size 123KB
- SHA256 c1ee8cda5453171d0cc998c3049454587838560d4d40f67be1502d49fc25dbb4
Score3/10 -
- Target 2XMM J083026+524133-beta.exe
- Size 220KB
- SHA256 56a07e44b5f7b108badeed51f3ce778a34081096eac1acffa575bfa2e3674760
Score1/10 -
- Target 2XMM J083026+524133.3.exe
- Size 2.1MB
- SHA256 f3635481d14d01760ad4666f13e901a4fd392cec649b30d1c62a779fc8689a2a
Score4/10 -
- Target 2XMM J083026+524133.R.exe
- Size 1.9MB
- SHA256 e5c6136ab08cb922976380eff155437fd79e3eb5fcfb20b3209b5956dc78ad50
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Modify Registry
3Pre-OS Boot
1Bootkit
1