9ab9af03589bf3821e753a40c7b2899dccf7cc358bbb01b89bb87dc640a5cbb4 | Triage

Sharing

General

Target

9ab9af03589bf3821e753a40c7b2899dccf7cc358bbb01b89bb87dc640a5cbb4
Size

1.3MB
Sample

221124-1m7pesef5v
MD5

d08af005a79bb8e5f92e32b52874b722
SHA1

7a95179e88f4a6ee33192f13dfc5c2b9d8274bc6
SHA256

9ab9af03589bf3821e753a40c7b2899dccf7cc358bbb01b89bb87dc640a5cbb4
SHA512

c8893b32215d4b1d57f0143cdc9d7b809fa2adba2fad6826bad52310da0ecc355a06d6b832830e757480bd2174a507ab51d97b7873860f0bbee4c5b296f433b1
SSDEEP

24576:esabjkjys3jhmgWKU8tkYphKqK2B54cDW4EmolRCpSSup5Uixp2IQtHZq:esaPkp311Hf3KW1DW4iOSSuptv2d5

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  9ab9af03589bf3821e753a40c7b2899dccf7cc358bbb01b89bb87dc640a5cbb4
- Size
  
  1.3MB
- MD5
  
  d08af005a79bb8e5f92e32b52874b722
- SHA1
  
  7a95179e88f4a6ee33192f13dfc5c2b9d8274bc6
- SHA256
  
  9ab9af03589bf3821e753a40c7b2899dccf7cc358bbb01b89bb87dc640a5cbb4
- SHA512
  
  c8893b32215d4b1d57f0143cdc9d7b809fa2adba2fad6826bad52310da0ecc355a06d6b832830e757480bd2174a507ab51d97b7873860f0bbee4c5b296f433b1
- SSDEEP
  
  24576:esabjkjys3jhmgWKU8tkYphKqK2B54cDW4EmolRCpSSup5Uixp2IQtHZq:esaPkp311Hf3KW1DW4iOSSuptv2d5
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2