General
- Target package.exe
- Size 52KB
- Sample260810-pjnllaybrc
- SHA256 d632c2c0c7801c3da57cf849fe4b4ca8351d9a7fe73c31050bf5dbcc96a16791
- MD5 57e1882595acbfd3f55cb2c74f6aa872
- SHA1 2aeb40721476f6a77fc2ea5db965af29b5d6b444
- SHA512 91b574f4ebf663dfc64a1372ced3d45285f436fb4cae88710dd423c119a4f8997ea53d9d30e67676d9612a28c65f02c3531c166bff49e901c237d8257ee552f4
- SSDEEP 1536:CPRbLM/Nsxkvlml5/1r9t9t9mGQPONUW5:CJ8/SslWyOD
- TLSH T1EF33190BB39394FCC61AC17449FB6B337A31FC664521AF2E5654EA312F11E602E2E794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
package.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
package.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target package.exe
- Size 52KB
- SHA256 d632c2c0c7801c3da57cf849fe4b4ca8351d9a7fe73c31050bf5dbcc96a16791
- MD5 57e1882595acbfd3f55cb2c74f6aa872
- SHA1 2aeb40721476f6a77fc2ea5db965af29b5d6b444
- SHA512 91b574f4ebf663dfc64a1372ced3d45285f436fb4cae88710dd423c119a4f8997ea53d9d30e67676d9612a28c65f02c3531c166bff49e901c237d8257ee552f4
- SSDEEP 1536:CPRbLM/Nsxkvlml5/1r9t9t9mGQPONUW5:CJ8/SslWyOD
- TLSH T1EF33190BB39394FCC61AC17449FB6B337A31FC664521AF2E5654EA312F11E602E2E794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1