eaf9e1d0bf818be07b782eab30e440a457f39cf63da41d2d5784a46d560e4a21 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eaf9e1d0bf818be07b782eab30e440a457f39cf63da41d2d5784a46d560e4a21
Size

995KB
Sample

221011-nqqh4acdg9
MD5

7cd691cc3df1b6f2d47f81b44f311490
SHA1

4b4e3e353ba8d8f37914713158c6d3ce32c8e7bc
SHA256

eaf9e1d0bf818be07b782eab30e440a457f39cf63da41d2d5784a46d560e4a21
SHA512

2f1e9c3457ce2a679bc22d13e4e72c01d2c693101850277c17f601d9c8e9620685268bf3c3e5535dbce1d1b65d46d9f702a8f8c9c05eeac6a02d7fbab4c6e6f8
SSDEEP

24576:rYtn7b3ExW0feha2YuRHm85IYt9Hj6jltTQym5yg1:rIf3Z0fj2tG2ytpm5yg1

Score

10^/10

evasion persistence ransomware spyware stealer trojan

Malware Config

Targets

- Target
  
  eaf9e1d0bf818be07b782eab30e440a457f39cf63da41d2d5784a46d560e4a21
- Size
  
  995KB
- MD5
  
  7cd691cc3df1b6f2d47f81b44f311490
- SHA1
  
  4b4e3e353ba8d8f37914713158c6d3ce32c8e7bc
- SHA256
  
  eaf9e1d0bf818be07b782eab30e440a457f39cf63da41d2d5784a46d560e4a21
- SHA512
  
  2f1e9c3457ce2a679bc22d13e4e72c01d2c693101850277c17f601d9c8e9620685268bf3c3e5535dbce1d1b65d46d9f702a8f8c9c05eeac6a02d7fbab4c6e6f8
- SSDEEP
  
  24576:rYtn7b3ExW0feha2YuRHm85IYt9Hj6jltTQym5yg1:rIf3Z0fj2tG2ytpm5yg1
Score

10^/10

evasion persistence ransomware spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceransomwarespywarestealertrojan

behavioral2

evasionpersistencetrojan