1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4 | Triage

Sharing

General

Target

1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
Size

228KB
Sample

221027-fvjbksaha9
MD5

f37f9160e2cf021983080ee0046529be
SHA1

65095a67c453db178b5735e7ecbeccbf1338ed75
SHA256

1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
SHA512

e02014e203c776bf8f11ebd48dc9abf132a8a907fa87e21b0f37306b0924f56dce99af7ed5fbcd862b3c6173c7cf09335c2fc1d4edc6f5753bd16bfdbab2d5de
SSDEEP

3072:at02MzGJiEWNgZEYCATuvcurAVI0XN0bHJJ2yMUp7JaHVKFqa:bNNguNATkAVI0iLFMiIKFqa

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
- Size
  
  228KB
- MD5
  
  f37f9160e2cf021983080ee0046529be
- SHA1
  
  65095a67c453db178b5735e7ecbeccbf1338ed75
- SHA256
  
  1f7d74e5ccf5681021323717359fb3efc6213d45ee84628c56f476f856477df4
- SHA512
  
  e02014e203c776bf8f11ebd48dc9abf132a8a907fa87e21b0f37306b0924f56dce99af7ed5fbcd862b3c6173c7cf09335c2fc1d4edc6f5753bd16bfdbab2d5de
- SSDEEP
  
  3072:at02MzGJiEWNgZEYCATuvcurAVI0XN0bHJJ2yMUp7JaHVKFqa:bNNguNATkAVI0iLFMiIKFqa
Score

8^/10

discovery persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence