Overview

overview

10

Static

static

490abd45a6...f9.exe

windows7-x64

10

490abd45a6...f9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9

  • Size

    212KB

  • Sample

    221107-wz7gzaeafl

  • MD5

    0cefbca50a38c7eceab0c685084dde2a

  • SHA1

    8669e329abad25eddbcfa0d969f180e3421dab29

  • SHA256

    490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9

  • SHA512

    c81a1264cfb4b553afbcf0e9c538dea3a9d9b8d52e7441e456b314e70c6f42803974d83ac8232050a3af5d7e384cb4863fd55f0332731f1564ded96ce71ff2f8

  • SSDEEP

    3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQ6++M4EE0yxoFwq+hbWX3M:gDCwfG1bnxLERRy+Ml6/q+hKX3M

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9

    • Size

      212KB

    • MD5

      0cefbca50a38c7eceab0c685084dde2a

    • SHA1

      8669e329abad25eddbcfa0d969f180e3421dab29

    • SHA256

      490abd45a6ab106ba5b5b2f2f5febf5330d20cc6191a916f2400864eba1b48f9

    • SHA512

      c81a1264cfb4b553afbcf0e9c538dea3a9d9b8d52e7441e456b314e70c6f42803974d83ac8232050a3af5d7e384cb4863fd55f0332731f1564ded96ce71ff2f8

    • SSDEEP

      3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQ6++M4EE0yxoFwq+hbWX3M:gDCwfG1bnxLERRy+Ml6/q+hKX3M

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks