59fe7345e0be81520b6599981e9729c8529da15e45503877a6faad7a383a9b34 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7841954e260efd4e3cef2a5371f43286.exe
Size

319KB
Sample

220918-qq8e1sfbhn
MD5

7841954e260efd4e3cef2a5371f43286
SHA1

ddc7770fe061d8d935cad11f56ae7ccb550f7de8
SHA256

59fe7345e0be81520b6599981e9729c8529da15e45503877a6faad7a383a9b34
SHA512

e0c45be4ee0f313009c55401611734484a22e53b5d309bd0d938115c4cb2f5c4cc55b94e93805698197648a1f03e77ed1e418ce0a118ef30388629e81fb1343c
SSDEEP

6144:h0LgM3q34lqOu1ECOIPsmZl5Hl/QwL+9GoGN9q9hpJv64x7xxxIkMkMkMkqUkkku:6cM3qBOu1ECOIP7Hiw693XN

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  7841954e260efd4e3cef2a5371f43286.exe
- Size
  
  319KB
- MD5
  
  7841954e260efd4e3cef2a5371f43286
- SHA1
  
  ddc7770fe061d8d935cad11f56ae7ccb550f7de8
- SHA256
  
  59fe7345e0be81520b6599981e9729c8529da15e45503877a6faad7a383a9b34
- SHA512
  
  e0c45be4ee0f313009c55401611734484a22e53b5d309bd0d938115c4cb2f5c4cc55b94e93805698197648a1f03e77ed1e418ce0a118ef30388629e81fb1343c
- SSDEEP
  
  6144:h0LgM3q34lqOu1ECOIPsmZl5Hl/QwL+9GoGN9q9hpJv64x7xxxIkMkMkMkqUkkku:6cM3qBOu1ECOIP7Hiw693XN
Score

8^/10

persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2