9fac553026291fb459144994c41f8c51a0a407229fbd30e3dcf7849d02b6c208

General

Target
WindowsSecurityService.zip
Size 36.5MB
Sample260626-ycfrvaev3v
SHA256 9fac553026291fb459144994c41f8c51a0a407229fbd30e3dcf7849d02b6c208
MD5 40f8dac56a36962ddbb559e968de8d26
SHA1 9ca99629b7e0f4ebad2a212f4ce939a1dbd46624
SHA512 5c8f681c0e7005fae09f3ce21ad9488a506501764c414902890dbee06a537571bfd986408e89a6ca002b84759e45ef8289c66f81f69ffcb5e57d41abe6afd0d7
SSDEEP 786432:955GEplhR1MSHEMIgvFEvELNGzQweTDxlhGV25TyW9U884eU:955pZDkMIgvWrfevxlh2ETjUxU
TLSH
T1D9872272D2AC41F3CE1E28315A6F83CD81C9650523167947BF904AA1F9C9CCEBBB6791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  WindowsSecurityService/WindowsSecurityService.exe
- Size 101KB
- SHA256 d72294fb338bc2fc8896d25a7395a4db466425427e1559e77185d5135a830681
- MD5 72afbe203882951dc77a5cf6dcc07ffe
- SHA1 e42f23434e8323d695cb249e686692794dba385e
- SHA512 426dc0e1ab31b895f7b5ef04ee4be52f562c03e856bda4569cd7052fe0aa3f15404f240f73bf8d2bb5e87240aa6671fdf8601d8b52e3b21a858a7f2e21b089dd
- SSDEEP 1536:Csef7hIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/T5sCytH/9wfIW44zqrhO:CsOSwMpdCq/IM8uIGf1/T5sLW4IKh
- TLSH
  T1F5A30841E62DBDCDE508D4314A75D4F26D24ED727680A51EB7F37F0628312A3FA0A93A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  WindowsSecurityService/WindowsSecurityService.lnk
- Size 23KB
- SHA256 e670613d3973a15b161933afccc355b9e0292a8c98a781e8aa3c1acb7895c0a5
- MD5 2c76cf4cc63e40964215416033acf2b9
- SHA1 b2f2e2f285748bfa5df26c17e2ce3918ac415a26
- SHA512 f96ad3eaffaa3d486afd1b9ec026afcfec2c1c61152efd2a96819b835dac7dffa79da3f716f63ce51cf03ae638338b5f907a623b8b78b1a96cff300377c27541
- SSDEEP 384:4hazqqYoETvROY7Cv7Q7y1ht1NOU3eq/2yOw6MzvjNxkmNLF9c9fqsS:4hXqq5OoCvsm7NB19zvkmNLzMS
- TLSH
  T105B29FB875C80EA1D2FA5ABFC7793B9252B32A21CA8BF0DD445471C50873337EE6101A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  WindowsSecurityService/WindowsSecurityService.py
- Size 10KB
- SHA256 67eb7d9aabbd6d6af32c189e5bb4f922500b14a4d2e921b7e98c048ddbb45bb4
- MD5 9b31ba45223de99562e1411b745249d5
- SHA1 70a39f869deeea3798934a56c40176c7fb5b7d74
- SHA512 8205b2c2be365dbf2d1f36516195fa494d78ab936120be57196c7b4ecac6decd271ad6424cc8af008273bf9da4ded5d803ac918b3a1d63cdbf41caf2db08a5c5
- SSDEEP 192:el2e9BRXNo30i+xuTLGB/0VBtZthWO1QvQ98bedTBuT3OqBC:eD9BJ40iCMtZzV1Qvuo3OV
- TLSH
  T1E3226C02CDB9ADF0DA8A54209A1DE5CB024FA82F205A7864FDDCD150BFD4AF081D26FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6