7040149d7fa3eb3c108358d5bbaa47ef65ae2155d0c1d128236040d0b27c879b | Triage

Sharing

General

Target

7040149d7fa3eb3c108358d5bbaa47ef65ae2155d0c1d128236040d0b27c879b
Size

133KB
Sample

221020-2gf5yshdam
MD5

79fc575d208320a6488485217120ddd0
SHA1

caf07c3d4385aba6cfcc8aaaeb62bb57086cc578
SHA256

7040149d7fa3eb3c108358d5bbaa47ef65ae2155d0c1d128236040d0b27c879b
SHA512

d2f54ea7f2566cba37e03b0afe30863d44c8b3b71c9d5ae38cd1dba02701b30cb15b6fd857ba67ade0560e6d407908fb23725055720a4cce3e7107393f031896
SSDEEP

1536:8CRDEF74bTxku0WlxDMtCeAHmHeTZrCg:HIo2IfJPm+Tl9

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  7040149d7fa3eb3c108358d5bbaa47ef65ae2155d0c1d128236040d0b27c879b
- Size
  
  133KB
- MD5
  
  79fc575d208320a6488485217120ddd0
- SHA1
  
  caf07c3d4385aba6cfcc8aaaeb62bb57086cc578
- SHA256
  
  7040149d7fa3eb3c108358d5bbaa47ef65ae2155d0c1d128236040d0b27c879b
- SHA512
  
  d2f54ea7f2566cba37e03b0afe30863d44c8b3b71c9d5ae38cd1dba02701b30cb15b6fd857ba67ade0560e6d407908fb23725055720a4cce3e7107393f031896
- SSDEEP
  
  1536:8CRDEF74bTxku0WlxDMtCeAHmHeTZrCg:HIo2IfJPm+Tl9
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence