ab05382e17b008e0681ae891407740a665a92b4a12ac80e1eaac9834c5833a95 | Triage

Sharing

General

Target

ab05382e17b008e0681ae891407740a665a92b4a12ac80e1eaac9834c5833a95
Size

220KB
Sample

221123-xry2asfg95
MD5

1ce5d5ff81e73472a6e0f8304160ee23
SHA1

12103f19ba727e70cb5b5997bbdb73c4943056d1
SHA256

ab05382e17b008e0681ae891407740a665a92b4a12ac80e1eaac9834c5833a95
SHA512

09af1c519a198eaf76127480b1b60ef916cb7997064e71894a823ddff534f007cae8abf27a4fc431ed017925523d4aa245f6b1223462e85a5793cfa1046e0267
SSDEEP

3072:YCR1Sr0kY8YUL4qx9RIHgil3UuhSa3U3dD8d6Oy+MIrnj3JjNG4:31Sokx15x9SHVeOjf9

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  ab05382e17b008e0681ae891407740a665a92b4a12ac80e1eaac9834c5833a95
- Size
  
  220KB
- MD5
  
  1ce5d5ff81e73472a6e0f8304160ee23
- SHA1
  
  12103f19ba727e70cb5b5997bbdb73c4943056d1
- SHA256
  
  ab05382e17b008e0681ae891407740a665a92b4a12ac80e1eaac9834c5833a95
- SHA512
  
  09af1c519a198eaf76127480b1b60ef916cb7997064e71894a823ddff534f007cae8abf27a4fc431ed017925523d4aa245f6b1223462e85a5793cfa1046e0267
- SSDEEP
  
  3072:YCR1Sr0kY8YUL4qx9RIHgil3UuhSa3U3dD8d6Oy+MIrnj3JjNG4:31Sokx15x9SHVeOjf9
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence