0799a3edf3b249c84f7b0afbc9f2ac1462b20fd9b8f2395ee650281cf0924594 | Triage

Sharing

General

Target

0799a3edf3b249c84f7b0afbc9f2ac1462b20fd9b8f2395ee650281cf0924594
Size

280KB
Sample

221011-zh9sjsdfc9
MD5

6c24d35b1b683b7ebe8b282ef09d9104
SHA1

a2601d85e744b83a362c766989efe45a83a3af16
SHA256

0799a3edf3b249c84f7b0afbc9f2ac1462b20fd9b8f2395ee650281cf0924594
SHA512

125767b71f140612e4cb67c8af1da0f8d521f93a2244bc36b3f80634c6bf4006cb2160e233aa95f88c14e102360113ad42753ea0ba28f0d2de76bbfe43cb758f
SSDEEP

3072:DkW/vx6kT/Ozb1/7Vc1tdjZQQLnQhhyBZ8Irfdaqebssot7rFVtWzdbcMmBX:DPEK2bVMJuQ0hhynfdaJqNrtWzCn

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  0799a3edf3b249c84f7b0afbc9f2ac1462b20fd9b8f2395ee650281cf0924594
- Size
  
  280KB
- MD5
  
  6c24d35b1b683b7ebe8b282ef09d9104
- SHA1
  
  a2601d85e744b83a362c766989efe45a83a3af16
- SHA256
  
  0799a3edf3b249c84f7b0afbc9f2ac1462b20fd9b8f2395ee650281cf0924594
- SHA512
  
  125767b71f140612e4cb67c8af1da0f8d521f93a2244bc36b3f80634c6bf4006cb2160e233aa95f88c14e102360113ad42753ea0ba28f0d2de76bbfe43cb758f
- SSDEEP
  
  3072:DkW/vx6kT/Ozb1/7Vc1tdjZQQLnQhhyBZ8Irfdaqebssot7rFVtWzdbcMmBX:DPEK2bVMJuQ0hhynfdaJqNrtWzCn
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence