General
- Target KitchenAid-Global_Digital_Growth_Partnership.1.8.3.zip
- Size 58.6MB
- Sample261024-gr2jesgs2y
- SHA256 84f41d47fb99fea279f6c9fc6f1ed32ca31e32697ea29394c6279972dd729b98
Score
7/10
Malware Config
Targets
-
- Target KitchenAid-Global_Digital_Growth_Partnership.1.8.3/8.5.0.3590/capcut.exe
- Size 781.0MB
- SHA256 0a0f35ef2e5b49d503253c9e737a29c913786bf57457e4096dce9df7e1db2973
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target KitchenAid-Global_Digital_Growth_Partnership.1.8.3/KitchenAid-Global_Digital_Growth_Partnership.scr
- Size 4.7MB
- SHA256 aaa072b211b33214251f202097f231cd26b7450b21376029771b6c84271620c1
Score6/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target KitchenAid-Global_Digital_Growth_Partnership.1.8.3/KitchenAid.mp4
- Size 2.0MB
- SHA256 a956c016041f9d0fc564e3adf1ea243da42f4d37e9b71e746925a51229837f18
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Debugger Evasion
2Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
1