Overview
overview
8Static
static
320260824.exe
windows10-2004-x64
820260824.exe
windows11-ltsc_2024-x64
8MSOCF.dll
windows10-2004-x64
8MSOCF.dll
windows11-ltsc_2024-x64
8msvcp100.dll
windows10-2004-x64
3msvcp100.dll
windows11-ltsc_2024-x64
3msvcr100.dll
windows10-2004-x64
3msvcr100.dll
windows11-ltsc_2024-x64
3General
- Target 20260824 1.img
- Size 4.4MB
- Sample260823-3mnmnabm7w
- SHA256 8b141a7c5d8af94ed37ea2b5dd676f9cb105ba8a6eedda36349899a2f1d065ff
- MD5 210e954cd8abf26470bf8a3824e508ec
- SHA1 24ec7d7dd5e074d520d5c1209605d10e99b8d6b4
- SHA512 c6d1e7368a685d64613ffc7264c6440d5e1ba9cd5f9f89071ffd03d77fa42f3fa9be7d5289f082e38684ebeaecf5672f087078437c817b7f923b19e8486cfea0
- SSDEEP 98304:w3zOF3iNKrsbXXKLTMu6bjQjBpkGW3s2v3CC:wKF3iwsbnKLTMu6wjBpkV3x
- TLSH T1EA26AD326A524871F45192300214EAA9366E7D209233DE9B62C6FDAEFFF43C159E353D
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
20260824.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
20260824.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
MSOCF.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
MSOCF.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
msvcp100.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
msvcp100.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
msvcr100.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
msvcr100.dll
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 20260824.EXE
- Size 911KB
- SHA256 5d8d20ab8008d5e8cd6ff7b44273fc4a13d30e97d1c7b295aa0786da7ac1f9e3
- MD5 bdb4eb8ec9e39825f0fd90048b36a89d
- SHA1 f67700223aff738d994c07e840712f35d91eac3f
- SHA512 21395c05e89a696f774a5849d57759e7ef95bce82b4ed5b439acb60a4eb63b6aa4b7023bd5e03e437334d709279294f0be09a878f93b43f9ef95538e1ddae918
- SSDEEP 3072:Yw11PTl76KpiSjAl3okWOF4rtinsietwZTtcihJibnqtaKR2jpZ5ydOtydMgtPeb:p1opSa3xWOF4
- TLSH T1D7151A712A625931F811CA310561ED9D326E7E18E923CE5A2186FDCFFBF56C21AC213D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Drops file in Drivers directory
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target MSOCF.dll
- Size 2.3MB
- SHA256 04c9eae9f19a63e4a84da108fe6b768ab6e558c89126dbb6c35a0c383739a81f
- MD5 4594075322ac0c9bd08828f8064aa576
- SHA1 47fe4a7f7e70ec5ebe47c06392fb0f5b073ff020
- SHA512 cfb3e761649c938b13b338df2c7f28d54ea35989687567fc6136f8879cb9b7835b4d2572f136b866e97deebab66349413d53bfcf0ef6bb511d45362d53c396cc
- SSDEEP 49152:ja3zOUVzaGPJ4yOXiNKrswwXXkbLTai4284Cji6bj8LOSUmrdV9:u3zOF3iNKrsbXXKLTMu6bjQjBpT
- TLSH T138B5238AFD6614F0C9EEB3383224393857397A72D6B809771B90825A1B7CFD17B35261
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Drops file in Drivers directory
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target msvcp100.dll
- Size 411KB
- SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
- MD5 e3c817f7fe44cc870ecdbcbc3ea36132
- SHA1 2ada702a0c143a7ae39b7de16a4b5cc994d2548b
- SHA512 4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
- SSDEEP 12288:zNb8zxr1aWPaHX7dGP57rhUgiW6QR7t5qv3Ooc8UHkC2ejGH:zNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eKH
- TLSH T10E9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target msvcr100.dll
- Size 755KB
- SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
- MD5 bf38660a9125935658cfa3e53fdc7d65
- SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
- SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
- SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
- TLSH T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1