60a6aa444331656badc74182e3180e7ca683f2843af9977b5ebf1a60ef8478b7 | Triage

Sharing

General

Target

60a6aa444331656badc74182e3180e7ca683f2843af9977b5ebf1a60ef8478b7
Size

512KB
Sample

221001-26b8ascehr
MD5

7311a54a7d0699bc6e77e5540fd89a60
SHA1

4e4ff6bdcf2882875a39b40a343c13c2982a1357
SHA256

60a6aa444331656badc74182e3180e7ca683f2843af9977b5ebf1a60ef8478b7
SHA512

a89a7588c5b22eb79a33b526c8e66b1e470574a15c1e1347939e3c0e76c961463904c6a8afbf593b03eeba203444e63df3b5ed8b4c6b917d2606aecca162e2a2
SSDEEP

12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4j:0+h9OY70z+warul3E4j

Score

9^/10

evasion

Malware Config

Targets

- Target
  
  60a6aa444331656badc74182e3180e7ca683f2843af9977b5ebf1a60ef8478b7
- Size
  
  512KB
- MD5
  
  7311a54a7d0699bc6e77e5540fd89a60
- SHA1
  
  4e4ff6bdcf2882875a39b40a343c13c2982a1357
- SHA256
  
  60a6aa444331656badc74182e3180e7ca683f2843af9977b5ebf1a60ef8478b7
- SHA512
  
  a89a7588c5b22eb79a33b526c8e66b1e470574a15c1e1347939e3c0e76c961463904c6a8afbf593b03eeba203444e63df3b5ed8b4c6b917d2606aecca162e2a2
- SSDEEP
  
  12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4j:0+h9OY70z+warul3E4j
Score

9^/10

evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2