20f2c1a103f184536f306385fa2f7458908a0edc174efa28d3b576892667b98f | Triage

Sharing

General

Target

20f2c1a103f184536f306385fa2f7458908a0edc174efa28d3b576892667b98f
Size

260KB
Sample

221123-td9dbsgh4z
MD5

456da6d8714b90542ec945409b75cba0
SHA1

62dd67e56b88e9dcf73a9fde6179614500aadd00
SHA256

20f2c1a103f184536f306385fa2f7458908a0edc174efa28d3b576892667b98f
SHA512

4ffca508581052b51f920e96bba5c23635dec91ec217ee8291551571f7a0b78f0f9cdcc77bb428aa4abfc01a6d960a78e133df7927567a6aa3b55c09b3d01d0f
SSDEEP

3072:Zw9ei+xWdwTiE64j9a45Kf/4xLMfKdRR7yH3TFavCPQjIYQHCd8boxQVV/V3xion:ejdwT/6qKWmH3TFCCoNLx+VH

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  20f2c1a103f184536f306385fa2f7458908a0edc174efa28d3b576892667b98f
- Size
  
  260KB
- MD5
  
  456da6d8714b90542ec945409b75cba0
- SHA1
  
  62dd67e56b88e9dcf73a9fde6179614500aadd00
- SHA256
  
  20f2c1a103f184536f306385fa2f7458908a0edc174efa28d3b576892667b98f
- SHA512
  
  4ffca508581052b51f920e96bba5c23635dec91ec217ee8291551571f7a0b78f0f9cdcc77bb428aa4abfc01a6d960a78e133df7927567a6aa3b55c09b3d01d0f
- SSDEEP
  
  3072:Zw9ei+xWdwTiE64j9a45Kf/4xLMfKdRR7yH3TFavCPQjIYQHCd8boxQVV/V3xion:ejdwT/6qKWmH3TFCCoNLx+VH
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence