877bf05a5567d27825a108bdeb3803f0f83d2d0030cbef04037c0ee5b6dcadb9 | Triage

Sharing

General

Target

877bf05a5567d27825a108bdeb3803f0f83d2d0030cbef04037c0ee5b6dcadb9
Size

172KB
Sample

221123-t7yhxsgb87
MD5

4af9cdf1bc89d13b2b2433edbf6372b8
SHA1

4e414169d91e0120b9014662c05b5ae16e8c1562
SHA256

877bf05a5567d27825a108bdeb3803f0f83d2d0030cbef04037c0ee5b6dcadb9
SHA512

f9a81468e0caa129649460a0e605351fe75d296f8c6a94f180880a29e663fbda6091741c4cbe6993f0fee9c5e11957209830b8a7a859bc8522d35efc4a96b228
SSDEEP

3072:hqjM39eB8R8oSx/mOEAFIFR7N3ims2+9AhLOG7GQiCLMt8Xq/WL8mgeh:hqj09hR8oSx/mOEAFIFR7NHl++hLOG7b

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  877bf05a5567d27825a108bdeb3803f0f83d2d0030cbef04037c0ee5b6dcadb9
- Size
  
  172KB
- MD5
  
  4af9cdf1bc89d13b2b2433edbf6372b8
- SHA1
  
  4e414169d91e0120b9014662c05b5ae16e8c1562
- SHA256
  
  877bf05a5567d27825a108bdeb3803f0f83d2d0030cbef04037c0ee5b6dcadb9
- SHA512
  
  f9a81468e0caa129649460a0e605351fe75d296f8c6a94f180880a29e663fbda6091741c4cbe6993f0fee9c5e11957209830b8a7a859bc8522d35efc4a96b228
- SSDEEP
  
  3072:hqjM39eB8R8oSx/mOEAFIFR7N3ims2+9AhLOG7GQiCLMt8Xq/WL8mgeh:hqj09hR8oSx/mOEAFIFR7NHl++hLOG7b
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence