Overview

overview

8

Static

static

1

AssetExter...al.lnk

windows10-2004-x64

8

AssetExter...al.lnk

windows11-ltsc_2024-x64

8

AssetExter...ss.dll

windows10-2004-x64

1

AssetExter...ss.dll

windows11-ltsc_2024-x64

1

AssetExter...es.bat

windows10-2004-x64

8

AssetExter...es.bat

windows11-ltsc_2024-x64

8

AssetExter...ry.dll

windows10-2004-x64

1

AssetExter...ry.dll

windows11-ltsc_2024-x64

1

Mal/AssetE...al.lnk

windows10-2004-x64

8

Mal/AssetE...al.lnk

windows11-ltsc_2024-x64

8

Mal/AssetE...ss.dll

windows10-2004-x64

1

Mal/AssetE...ss.dll

windows11-ltsc_2024-x64

1

Mal/AssetE...es.bat

windows10-2004-x64

8

Mal/AssetE...es.bat

windows11-ltsc_2024-x64

8

Mal/AssetE...ry.dll

windows10-2004-x64

1

Mal/AssetE...ry.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Mal.rar
  • Size 7KB
  • Sample260808-31te3azzgx
  • SHA256 f40ef56f433ed61125cb69a9332d9584797de14e8d96d890452599fa5bf7e333
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecution

Malware Config

Targets

    • Target
      AssetExternalV8/AssetExternal.lnk
    • Size 1KB
    • SHA256 6dd4256f5e5818225f2ed4f2d378b9b70be3ccc52c70ea4d24ff1c338e4f9f5a
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    defense_evasiondiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2
    • Target
      AssetExternalV8/dependencies/ACbypass.dll
    • Size 4KB
    • SHA256 f22234b64d4a4a7a15410ee5d31d1bbe0b0cdfcfb43e073bb731c8abbdd54cba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      AssetExternalV8/dependencies/Libraries.bat
    • Size 3KB
    • SHA256 8c224b994c1fbe4af638b8a8bb0ce7b2f49472e8fd296716516e0bc35d5d6524
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    defense_evasionexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    behavioral5behavioral6
    • Target
      AssetExternalV8/dependencies/memory.dll
    • Size 37KB
    • SHA256 5f64f09bd93009ea1f53838aca3a4072e6ca6b3cb7f13b1c01af2977371e54fb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      Mal/AssetExternalV8/AssetExternalV8/AssetExternal.lnk
    • Size 1KB
    • SHA256 6dd4256f5e5818225f2ed4f2d378b9b70be3ccc52c70ea4d24ff1c338e4f9f5a
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    defense_evasionexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral10behavioral9
    • Target
      Mal/AssetExternalV8/AssetExternalV8/dependencies/ACbypass.dll
    • Size 4KB
    • SHA256 f22234b64d4a4a7a15410ee5d31d1bbe0b0cdfcfb43e073bb731c8abbdd54cba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      Mal/AssetExternalV8/AssetExternalV8/dependencies/Libraries.bat
    • Size 3KB
    • SHA256 8c224b994c1fbe4af638b8a8bb0ce7b2f49472e8fd296716516e0bc35d5d6524
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    defense_evasionexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    behavioral13behavioral14
    • Target
      Mal/AssetExternalV8/AssetExternalV8/dependencies/memory.dll
    • Size 37KB
    • SHA256 5f64f09bd93009ea1f53838aca3a4072e6ca6b3cb7f13b1c01af2977371e54fb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16

MITRE ATT&CK Enterprise v16

Tasks