397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1 | Triage

Sharing

General

Target

397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1
Size

228KB
Sample

221002-a7kghsedb6
MD5

6dd4f6fc9408bda3ab46f40236652fc9
SHA1

b814e6375f343c3ed2193a8d1b927ebdc09ced35
SHA256

397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1
SHA512

8558fcd6b8785a803b079be2f2a02739730a7cf64a6da8d6ce88cc73ea89d008f0a015bb4966baff727b2f365f8f71b457b56cabeb0147be7806843aa8f397b0
SSDEEP

6144:hGtFwzWQTi2+OMcppIRW30d+h8wZ2Uf/T11cradKtvr1K/fObT/bGipKgJJeZ4c7:OFwrKOMcppIRW3M+hwUf/Z1craduvr1K

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1
- Size
  
  228KB
- MD5
  
  6dd4f6fc9408bda3ab46f40236652fc9
- SHA1
  
  b814e6375f343c3ed2193a8d1b927ebdc09ced35
- SHA256
  
  397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1
- SHA512
  
  8558fcd6b8785a803b079be2f2a02739730a7cf64a6da8d6ce88cc73ea89d008f0a015bb4966baff727b2f365f8f71b457b56cabeb0147be7806843aa8f397b0
- SSDEEP
  
  6144:hGtFwzWQTi2+OMcppIRW30d+h8wZ2Uf/T11cradKtvr1K/fObT/bGipKgJJeZ4c7:OFwrKOMcppIRW3M+hwUf/Z1craduvr1K
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence