d81966c1c0c377b36836622b03eb8acf392857e29aefc44135ed50fe1002fc87 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bad.img
Size

804KB
Sample

220926-trbzzscebk
MD5

e70ce0aba62d4b668a5e2b23a99ab526
SHA1

9a044bf6aac6a35d2e30e8cda78b079372a28503
SHA256

d81966c1c0c377b36836622b03eb8acf392857e29aefc44135ed50fe1002fc87
SHA512

cc4e4f2d77e2f84c03dd5995cb16c35595b0a74cf5fc75bdd51232472fe5a86bd06af21f7284540e46ee5bcdf59fcab6c666dbad25619b16341dfd68e98db637
SSDEEP

12288:PoKYjeTEWpQwSzxesgwgnYv8iRMcobbE/fGrBxXtR4b57bukxPgs8jnRI:fPEiQwSzENwPfKM/fGVx4NJxIs8jn

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  Product_Details_188001_RFQ.exe
- Size
  
  752KB
- MD5
  
  23425ae1ae3c3daf49f96396ef2032be
- SHA1
  
  5d14fe99c1f0d0f495c61d21667c11f428f9d367
- SHA256
  
  a2e65c98bed9b341d0abc1ab3fe49e5aceb7705689143bce87bb0b45b213935a
- SHA512
  
  c0f1de87613b5cc5a2c7ce3f5347174d379d452a97938a9dee276f3093064453ecac1db344d965bfd97b346540e977baecb6129d25d1d9420e3ab1f9709d7487
- SSDEEP
  
  12288:poKYjeTEWpQwSzxesgwgnYv8iRMcobbE/fGrBxXtR4b57bukxPgs8jnRI:RPEiQwSzENwPfKM/fGVx4NJxIs8jn
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2