9aa70477be932d2e8b26eb43e8235a024ba79e7ec4285652e9880cab294b67e8

General

Target
BacteriaMBR.exe
Size 13KB
Sample261030-t7pwsadw2v
SHA256 9aa70477be932d2e8b26eb43e8235a024ba79e7ec4285652e9880cab294b67e8
MD5 7cf9549aea5a8dc33a1ab397907dcbfb
SHA1 f2838f8733e91ecac5e947056e0bb66855409a28
SHA512 b991dce87a52519c141e4b151d5ea1f7822940e0934e25700819ca3c34edbdee3464711a02ff14fbd1e882b33b528acf474dd55512f57e20454a6f7b090e8d17
SSDEEP 192:sORBAAF4drWpzdumfMDQPi5g9vkYXNCQhZw49PWlvP0cOODn43/dbn0:s2GS8m00Yg9vkgEWZw49PA8
TLSH
T1F452F6083BE8C501D1BF8F3A68BAE3504632F96A0533EB8F1DD240ED2D73A908559772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  BacteriaMBR.exe
- Size 13KB
- SHA256 9aa70477be932d2e8b26eb43e8235a024ba79e7ec4285652e9880cab294b67e8
- MD5 7cf9549aea5a8dc33a1ab397907dcbfb
- SHA1 f2838f8733e91ecac5e947056e0bb66855409a28
- SHA512 b991dce87a52519c141e4b151d5ea1f7822940e0934e25700819ca3c34edbdee3464711a02ff14fbd1e882b33b528acf474dd55512f57e20454a6f7b090e8d17
- SSDEEP 192:sORBAAF4drWpzdumfMDQPi5g9vkYXNCQhZw49PWlvP0cOODn43/dbn0:s2GS8m00Yg9vkgEWZw49PA8
- TLSH
  T1F452F6083BE8C501D1BF8F3A68BAE3504632F96A0533EB8F1DD240ED2D73A908559772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware collection credential_access defense_evasion discovery execution exploit persistence privilege_escalation ransomware spyware stealer
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Possible privilege escalation attempt
  exploit
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2