a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291 | Triage

Sharing

General

Target

a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291
Size

1.3MB
Sample

220503-xw6a6sdbbk
MD5

ce91f8d31da74fe243e6404a8866b2c1
SHA1

3929bb670d830dc1b990a338483d9fb389e63308
SHA256

a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291
SHA512

d0525dfcd869d2dc12045cafb31872c8b9c585ed85de002eb5027f28a7e59150bfd408134fcf947b0858b819c64148b760ca5efee4f61580ac7ef493a224391b

Score

8^/10

discovery evasion exploit

Malware Config

Targets

- Target
  
  a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291
- Size
  
  1.3MB
- MD5
  
  ce91f8d31da74fe243e6404a8866b2c1
- SHA1
  
  3929bb670d830dc1b990a338483d9fb389e63308
- SHA256
  
  a6963bb5ae9f8bd47ad12e371ddd633ca7dd7bdbe8d9d9ca09fd6f20f2442291
- SHA512
  
  d0525dfcd869d2dc12045cafb31872c8b9c585ed85de002eb5027f28a7e59150bfd408134fcf947b0858b819c64148b760ca5efee4f61580ac7ef493a224391b
Score

8^/10

discovery evasion exploit
- Modifies Windows Firewall
  evasion
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Impair Defenses

File Permissions Modification

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexploit

behavioral2

discoveryevasionexploit