Extracted

• • Target
    h024whbb5hru6tut(1).exe
  • Size 439KB
  • SHA256 a37d63bd716de20ff651ac03bb94c1495d536b1ff6b89b2f0b1c36daec106c49
  • MD5 a5eb7b6a08abdbf040081fd7391735c8
  • SHA1 3bfbc9f8a8e05b0461ffea5244564686754bbeac
  • SHA512 967b5780c4a8fab3b1f539189653b8251b2ba322deacaaf843f273d816cdea6994dbd9a7e571bda7839b64502307efc2eb8e55f5f288690b4e8f4b196f363303
  • SSDEEP 12288:R+Xwjmh4EPui7qQ9MiqvOOZXRpuvt7TEP:wXwa3pvqjdRpMT
  • TLSH
    T16BA419257FA98E00D581257EC57E2A05CB26E0F225026303370AF7A15D459EFEE6D3EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalation

  • Modifies WinLogon for persistence

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2