General
- Target sample
- Size 294KB
- Sample260818-dgslzsfa92
- SHA256 7b0c6a009f135396dc2525e2d076a507a83cf929cb378a2d4358a096e5e7f554
- MD5 1e138056b63e892e569747332f9fffd0
- SHA1 88a562f3312dc80482bc7a70f32fe93f4df78eb7
- SHA512 8de2fc298ec9f93b9d919a05e05adff4eaaa4c3f6a03267af709550489ff6306664bfb69008f8a8ac4cd4e50816fbaee94e091e9fc23549c8e9a16dc4a5037c6
- SSDEEP 3072:XX+NCyzqMwL4bIdfr7enlkqLH5Tj1byU0AAIRWXFhy5YqFR:XX+NCyzq5L4Idf5qLH51WYAIuRqH
- TLSH T12B546C326300B43BA817DDA0A6BE6F4E3C25E12BCC1647F8A595E530DFD2EB2151A71D
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win10v2004-20260513-en
31 signatures
900 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win11ltsc2024-20260709-en
11 signatures
900 seconds
Malware Config
Targets
-
- Target sample
- Size 294KB
- SHA256 7b0c6a009f135396dc2525e2d076a507a83cf929cb378a2d4358a096e5e7f554
- MD5 1e138056b63e892e569747332f9fffd0
- SHA1 88a562f3312dc80482bc7a70f32fe93f4df78eb7
- SHA512 8de2fc298ec9f93b9d919a05e05adff4eaaa4c3f6a03267af709550489ff6306664bfb69008f8a8ac4cd4e50816fbaee94e091e9fc23549c8e9a16dc4a5037c6
- SSDEEP 3072:XX+NCyzqMwL4bIdfr7enlkqLH5Tj1byU0AAIRWXFhy5YqFR:XX+NCyzq5L4Idf5qLH51WYAIuRqH
- TLSH T12B546C326300B43BA817DDA0A6BE6F4E3C25E12BCC1647F8A595E530DFD2EB2151A71D
- MD5 SHA1 SHA512 SSDEEP TLSH
Suspicious use of NtCreateUserProcessOtherParentProcess
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1