c7d06593d05275d5e8d15de52f50489f0e17d203fa81f737ccde3903771def3f | Triage

Sharing

General

Target

c7d06593d05275d5e8d15de52f50489f0e17d203fa81f737ccde3903771def3f
Size

128KB
Sample

221123-xbx43ahe5t
MD5

48e8b0be9df9f977aeb8b1e53b09b184
SHA1

50ee308fe15b392367553f621a48b92bfc2c5b80
SHA256

c7d06593d05275d5e8d15de52f50489f0e17d203fa81f737ccde3903771def3f
SHA512

79c4ef350d03a3ba7f0c465a38b3ef9480cf423e37fd0bfd6e6d492cbceef92ccf32b9c0eb1f756b48c069d204b6d2dc8942275c814bc58f931704186db79781
SSDEEP

1536:oxcIYl02OnFLJiq6H48O6j6/t66366Z6Jz36k6eA66KD6sqG/Oji6FA8HxAH6xMQ:+TD2OnFtS3e50IMZZZZWMkIJs

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c7d06593d05275d5e8d15de52f50489f0e17d203fa81f737ccde3903771def3f
- Size
  
  128KB
- MD5
  
  48e8b0be9df9f977aeb8b1e53b09b184
- SHA1
  
  50ee308fe15b392367553f621a48b92bfc2c5b80
- SHA256
  
  c7d06593d05275d5e8d15de52f50489f0e17d203fa81f737ccde3903771def3f
- SHA512
  
  79c4ef350d03a3ba7f0c465a38b3ef9480cf423e37fd0bfd6e6d492cbceef92ccf32b9c0eb1f756b48c069d204b6d2dc8942275c814bc58f931704186db79781
- SSDEEP
  
  1536:oxcIYl02OnFLJiq6H48O6j6/t66366Z6Jz36k6eA66KD6sqG/Oji6FA8HxAH6xMQ:+TD2OnFtS3e50IMZZZZWMkIJs
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence