e95e65556f870e95dba680ec335dff360068504e9baa2449fe36f71c364fb78c | Triage

Sharing

General

Target

e95e65556f870e95dba680ec335dff360068504e9baa2449fe36f71c364fb78c
Size

158KB
Sample

221123-s1shnafg8z
MD5

1d10479a28c860f05bea76f040bf8b9b
SHA1

4042c514af7f3d82b70d14b5324c94f2df5c75e0
SHA256

e95e65556f870e95dba680ec335dff360068504e9baa2449fe36f71c364fb78c
SHA512

5bd2dc36f5350877bf2eaa73dda37edc2113219c176d739cbe06d658465e2d201cb0d2f49ca45bc3af01d1a2ac99e9b98a0391799b3ced8f19490784d54de83e
SSDEEP

3072:j3bcWE9QKUbbS4KvEBKRNxusB8Sh7zn6aqxJVsUphNbZhxnYeq+81:rAWwr4KjR/uyzRz6zJV7nbTxjq+81

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  Revised Proforma Invoice.pdf ___________________ Delivery Time and Packing.pdf ____________________ Open with Adobe Reader . pdf or in.exe
- Size
  
  348KB
- MD5
  
  bbf1bd69844f4620fd24564c2d87b37b
- SHA1
  
  4c31462b2e603aaab1d31974bb88c13675a95906
- SHA256
  
  1b6af48befb663a8e87b7aab01bacad2a088f51b825136bfaa3def268f925358
- SHA512
  
  4ee6d3c0b1cedb14456a98c8407598aec2b2c827ff5632fb0c0d30113ff2d2182396446521497c19afed9489d4293f94e54f127802b13f273e7b09132450f69e
- SSDEEP
  
  3072:Qs2cEhmHKgLksCxnUmakgGgC+YdSnu+T9T1c/SzBRby1SO6MP58XQWApvoL7Pd0f:Qs2A0leQUu+5Zc/YSUaC2vG0UF
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2