Overview

overview

10

Static

static

c1aaf2dd35...f6.exe

windows7-x64

10

c1aaf2dd35...f6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1aaf2dd35ca3f2374c391703d0f5c33a30462d5f0b65d39d7ede42dfa9419f6

  • Size

    152KB

  • Sample

    221123-tbj1nagf6s

  • MD5

    42fbccf64541cffa18ba28cd878d3250

  • SHA1

    ae00dd2eef075e74327a1136a35becfeb72d2675

  • SHA256

    c1aaf2dd35ca3f2374c391703d0f5c33a30462d5f0b65d39d7ede42dfa9419f6

  • SHA512

    5778b96b428fc163458d24130d6ede6fbce2263419596b4dcbad1d5d76a7d40078354784be3939aca28e0c58a76a490629c4dec943dc63c4e1f65dad1e87966d

  • SSDEEP

    3072:T3jIpK9xKA9w2p4QZisLaazNiIIkyyqN4oQZiEHPgcF:T3cpKxY+1isuazgfklcWVP3

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      c1aaf2dd35ca3f2374c391703d0f5c33a30462d5f0b65d39d7ede42dfa9419f6

    • Size

      152KB

    • MD5

      42fbccf64541cffa18ba28cd878d3250

    • SHA1

      ae00dd2eef075e74327a1136a35becfeb72d2675

    • SHA256

      c1aaf2dd35ca3f2374c391703d0f5c33a30462d5f0b65d39d7ede42dfa9419f6

    • SHA512

      5778b96b428fc163458d24130d6ede6fbce2263419596b4dcbad1d5d76a7d40078354784be3939aca28e0c58a76a490629c4dec943dc63c4e1f65dad1e87966d

    • SSDEEP

      3072:T3jIpK9xKA9w2p4QZisLaazNiIIkyyqN4oQZiEHPgcF:T3cpKxY+1isuazgfklcWVP3

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks