General
- Target Tax_Notice_99999.img
- Size 364KB
- Sample260804-3jg1psfr4s
- SHA256 3b9a990bbae531b874234fb499f9f6061bd64901eb3fdacae83b4c24b7991a6a
- MD5 6e71275fa1c73667ba78dee94c1c0fde
- SHA1 6a1618ba32e189bd6a2c40c82cf85350b88567c5
- SHA512 759e28f91d60844e9ee5d06cc9a28b03628ebada49507d5aa5fc4efac43d745b4e27a4abaee4c7b00e0a7821aca4d8cb5bba11ee075e8755c3018f3e9216d819
- SSDEEP 6144:XLbMNk1Nfm0rfQBqZE+peAn5IEJvMqTBJNFm:771Nfhu+1mqTnNFm
- TLSH T1C7847C81FB866EFAEC79447C8AB1662AFB71B0180374C35B369C9097DF132815D3A395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Tax_Notice_79175.exe
Resource
win10v2004-20260513-ja
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
nvml.dll
Resource
win10v2004-20260513-ja
0 signatures
150 seconds
Malware Config
Targets
-
- Target Tax_Notice_79175.exe
- Size 287KB
- SHA256 93694473622f770d539263ae211dde4715264b0f23c858ba69796adca76cae35
- MD5 c9afda4f027fc9510134cffcc4d54da3
- SHA1 c5b5fb5f06d1f6cf98afa0df97f57e9bd7b454ed
- SHA512 91fc95c20e93059a470c5d6506ce368581679cb7b43216b44a5a1f2e440eee1729523935943226ad488a98cfc7ac7ce5888bae01ed359962feb3eb01e9b8e458
- SSDEEP 6144:/bMNk1Nfm0rfQBqZE+peAn5IEJvMqTBJNFmU:/71Nfhu+1mqTnNFmU
- TLSH T15A547D81FB866EFAEC79447C8AF1662AFB70B0180364C35B26989097DF133915D3A3D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target nvml.dll
- Size 9KB
- SHA256 52a51af64a9081759bdf1df03158cb5a4a2e773a1e2b5d52caf6f2a9e79a15b0
- MD5 c8c9f2162879ad37b6c87ccc3bef8d57
- SHA1 16b928155d3502a88b23b0917d2ac9378a564846
- SHA512 aebca1f7624a4c8de0e9298657ce4891bd357098befb92aef5690417d32c74cdd4970acaffc375efdab909bfb3f20f2bba5e60e6e2afc7a36115c424c555fd9e
- SSDEEP 192:f3uDqfT2OLxnY5e89DWxjiAo6XS6zFbdDl9:f9tLNIWrzFpDl9
- TLSH T11A12D635F39718EAD853EF3066E655327876BC3816286E7E11E0EB3B2914CD4292CA02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1