283b712f27430a188570bf5c302819f0e5a7306424485fa64577009d9d496a35 | Triage

Sharing

General

Target

283b712f27430a188570bf5c302819f0e5a7306424485fa64577009d9d496a35
Size

232KB
Sample

221123-snfckabg56
MD5

69678dbdc1570b1ab8851b3816dbb1f7
SHA1

abe1f49f211f65d5ad065d0ccc424c5aca728324
SHA256

283b712f27430a188570bf5c302819f0e5a7306424485fa64577009d9d496a35
SHA512

0d1b563251e46e2a2942acad693b29d74d89212451e248174bfd893981d131e7b83761c09a841bf96a15e65b4133158f772b70135976bc91891e55e61f1f5585
SSDEEP

6144:2i8MyN8Z7cSDzbvC7MqzYhXEfmj+vuOaX6Jqp:0WpzbHDh0fYfTX6s

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  283b712f27430a188570bf5c302819f0e5a7306424485fa64577009d9d496a35
- Size
  
  232KB
- MD5
  
  69678dbdc1570b1ab8851b3816dbb1f7
- SHA1
  
  abe1f49f211f65d5ad065d0ccc424c5aca728324
- SHA256
  
  283b712f27430a188570bf5c302819f0e5a7306424485fa64577009d9d496a35
- SHA512
  
  0d1b563251e46e2a2942acad693b29d74d89212451e248174bfd893981d131e7b83761c09a841bf96a15e65b4133158f772b70135976bc91891e55e61f1f5585
- SSDEEP
  
  6144:2i8MyN8Z7cSDzbvC7MqzYhXEfmj+vuOaX6Jqp:0WpzbHDh0fYfTX6s
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2