General

  • Target

    a0dd834773c79331f816f7ec542286d60039a21579172cfd8404f03be1947140

  • Size

    1.1MB

  • Sample

    210511-bzh66lafbn

  • MD5

    b631377f00bc315a8db6fd527e87d8be

  • SHA1

    7232f2e9915b2a6e20af3cd29e25495ac77922fc

  • SHA256

    a0dd834773c79331f816f7ec542286d60039a21579172cfd8404f03be1947140

  • SHA512

    163ce73cc4b910366008bca6f051d9ce83c71d254bbcb58c490284a2869420a083e7403d0bd35507ad0dbcd30d2c0863374a303e0282a9b4299d4c330fc1c4e0

Score
8/10

Malware Config

Targets

    • Target

      a0dd834773c79331f816f7ec542286d60039a21579172cfd8404f03be1947140

    • Size

      1.1MB

    • MD5

      b631377f00bc315a8db6fd527e87d8be

    • SHA1

      7232f2e9915b2a6e20af3cd29e25495ac77922fc

    • SHA256

      a0dd834773c79331f816f7ec542286d60039a21579172cfd8404f03be1947140

    • SHA512

      163ce73cc4b910366008bca6f051d9ce83c71d254bbcb58c490284a2869420a083e7403d0bd35507ad0dbcd30d2c0863374a303e0282a9b4299d4c330fc1c4e0

    Score
    8/10
    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Tasks