669989432ada7c15fdf59b81937bdd023c304dac388ea857370b8d407064b18c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

669989432ada7c15fdf59b81937bdd023c304dac388ea857370b8d407064b18c
Size

204KB
Sample

221011-lpf7xsgee9
MD5

618311c2b07f9b43a47de0d68da69591
SHA1

6ab740ad837d48231380a7f664f216c05a93ef44
SHA256

669989432ada7c15fdf59b81937bdd023c304dac388ea857370b8d407064b18c
SHA512

79bccc286db1f77ab3f92c2873b3517a9f360d275de9947b7d94606edb884a9099858d71bf7b945d97469491fcfc556a13b3d6dca31df3471697271c3ae6912a
SSDEEP

6144:ws7JtuNngeO+cwjfTfGHN1RWrOy9uJV10BK+baPe3ObUrlBXvgd7Vc7Ia:wsKNngeO+cwjfTfGHN1Ax9uJV10BK+b3

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  669989432ada7c15fdf59b81937bdd023c304dac388ea857370b8d407064b18c
- Size
  
  204KB
- MD5
  
  618311c2b07f9b43a47de0d68da69591
- SHA1
  
  6ab740ad837d48231380a7f664f216c05a93ef44
- SHA256
  
  669989432ada7c15fdf59b81937bdd023c304dac388ea857370b8d407064b18c
- SHA512
  
  79bccc286db1f77ab3f92c2873b3517a9f360d275de9947b7d94606edb884a9099858d71bf7b945d97469491fcfc556a13b3d6dca31df3471697271c3ae6912a
- SSDEEP
  
  6144:ws7JtuNngeO+cwjfTfGHN1RWrOy9uJV10BK+baPe3ObUrlBXvgd7Vc7Ia:wsKNngeO+cwjfTfGHN1Ax9uJV10BK+b3
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence