Overview

overview

10

Static

static

4a6bbd8fda...18.exe

windows7-x64

10

4a6bbd8fda...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818

  • Size

    672KB

  • Sample

    221003-emkc8sgffk

  • MD5

    537d4dcf1d332bf09437b0d11549b1c0

  • SHA1

    6bd50743a64544b7901801ba456693c5d658c40f

  • SHA256

    4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818

  • SHA512

    e87da0d8f7518d259d3e382597f3d5cbcb884d6913850bd715db19f797d12c6b15775b2b37705223500cbacde6c2e15372433a165a4f4aadb1c03a6c70068450

  • SSDEEP

    6144:7dbELf/MR/cWdi5pV/JNWOVhMUVbELf/MR/e6xW1MFbKZ871HSrhVDeEt4169rBT:BdOpNX1hQ18bKKiZG16/

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818

    • Size

      672KB

    • MD5

      537d4dcf1d332bf09437b0d11549b1c0

    • SHA1

      6bd50743a64544b7901801ba456693c5d658c40f

    • SHA256

      4a6bbd8fda180cbd3db6e14ab53374b8aafd79dabe4f039ded9560311ebbc818

    • SHA512

      e87da0d8f7518d259d3e382597f3d5cbcb884d6913850bd715db19f797d12c6b15775b2b37705223500cbacde6c2e15372433a165a4f4aadb1c03a6c70068450

    • SSDEEP

      6144:7dbELf/MR/cWdi5pV/JNWOVhMUVbELf/MR/e6xW1MFbKZ871HSrhVDeEt4169rBT:BdOpNX1hQ18bKKiZG16/

    Score
    10/10
    evasionpersistence

    • Modifies firewall policy service

      evasion

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Hidden Files and Directories

2
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks