cff686161e0ebe726e374563c3ae4e41c8cda748e64470fc49376bcf4987e822 | Triage

Sharing

General

Target

cff686161e0ebe726e374563c3ae4e41c8cda748e64470fc49376bcf4987e822
Size

331KB
Sample

220919-phj7sagde7
MD5

215e9a0404b0b3ec2c0df890b6c4f0ed
SHA1

e32a5562b983774b8e8c2075d2ef9669ffd01b7b
SHA256

cff686161e0ebe726e374563c3ae4e41c8cda748e64470fc49376bcf4987e822
SHA512

64e8604204fe5695abd90a2ca1f08bbe97f3a147964ec9dc6482994dc63e49d30189d31af3b139c1b6d605c6c1a76b9d93c59aa3e73ec3018e85d15186152358
SSDEEP

6144:InNn4XRy93FwkrStCYHVJ4oi+GUOYIZDATPKDR4kZO8OtcykycZ:InN4XRyFFw4wJ5i7AjKmkDypcZ

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  cff686161e0ebe726e374563c3ae4e41c8cda748e64470fc49376bcf4987e822
- Size
  
  331KB
- MD5
  
  215e9a0404b0b3ec2c0df890b6c4f0ed
- SHA1
  
  e32a5562b983774b8e8c2075d2ef9669ffd01b7b
- SHA256
  
  cff686161e0ebe726e374563c3ae4e41c8cda748e64470fc49376bcf4987e822
- SHA512
  
  64e8604204fe5695abd90a2ca1f08bbe97f3a147964ec9dc6482994dc63e49d30189d31af3b139c1b6d605c6c1a76b9d93c59aa3e73ec3018e85d15186152358
- SSDEEP
  
  6144:InNn4XRy93FwkrStCYHVJ4oi+GUOYIZDATPKDR4kZO8OtcykycZ:InN4XRyFFw4wJ5i7AjKmkDypcZ
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2