60aa5f90e29ad2cbd61b7c080f1fc14adb6f73da4d85cb5d960e80ce93b57df6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

60aa5f90e29ad2cbd61b7c080f1fc14adb6f73da4d85cb5d960e80ce93b57df6
Size

320KB
Sample

221020-2mw4cshfcq
MD5

74302443831d6558dd7e4938f8d8b02f
SHA1

57c2df86885e382208eeafedceedd9b5397cabc5
SHA256

60aa5f90e29ad2cbd61b7c080f1fc14adb6f73da4d85cb5d960e80ce93b57df6
SHA512

fa29301c48d702db6de5401463eef131ae6f6559d1358d19cde24e9a4e644986cf7e16b017760f2be444b100a98d42573fd99d48931d9ca928aaf480b0cea795
SSDEEP

6144:iOIcFeEK/fObT/bGibErxUyF+fmYYdPMAaiSnh:iOIcFeEK/fObT/bGiPo+eYYt/LSnh

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  60aa5f90e29ad2cbd61b7c080f1fc14adb6f73da4d85cb5d960e80ce93b57df6
- Size
  
  320KB
- MD5
  
  74302443831d6558dd7e4938f8d8b02f
- SHA1
  
  57c2df86885e382208eeafedceedd9b5397cabc5
- SHA256
  
  60aa5f90e29ad2cbd61b7c080f1fc14adb6f73da4d85cb5d960e80ce93b57df6
- SHA512
  
  fa29301c48d702db6de5401463eef131ae6f6559d1358d19cde24e9a4e644986cf7e16b017760f2be444b100a98d42573fd99d48931d9ca928aaf480b0cea795
- SSDEEP
  
  6144:iOIcFeEK/fObT/bGibErxUyF+fmYYdPMAaiSnh:iOIcFeEK/fObT/bGiPo+eYYt/LSnh
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence