ac7b8f609810ca397e54528877948a402d3af4c560a54ae1b3eb59ea311bd2e8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac7b8f609810ca397e54528877948a402d3af4c560a54ae1b3eb59ea311bd2e8
Size

272KB
Sample

221124-aapd7sdg92
MD5

15bd01ec50d83259dd3b40854cb1d9b0
SHA1

c157d6f8a310e9dfcf0af0bce5dbbad7f71106ee
SHA256

ac7b8f609810ca397e54528877948a402d3af4c560a54ae1b3eb59ea311bd2e8
SHA512

e82943a124b5a404b7254b9476104d8cce9b27189a642ecbeda2ffce8dca6cfc4d331cacbbc869a245e0b9766a40bf86f1e9c268d1e2b4d7221e5a82eeab4760
SSDEEP

3072:M4p9gmss0FvbVJznCRcz/hVFA9MSs/PLLj+Qm4U3YwgTeA3fQi:tovbfznH7O9G/PLLxU3YwgT

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  ac7b8f609810ca397e54528877948a402d3af4c560a54ae1b3eb59ea311bd2e8
- Size
  
  272KB
- MD5
  
  15bd01ec50d83259dd3b40854cb1d9b0
- SHA1
  
  c157d6f8a310e9dfcf0af0bce5dbbad7f71106ee
- SHA256
  
  ac7b8f609810ca397e54528877948a402d3af4c560a54ae1b3eb59ea311bd2e8
- SHA512
  
  e82943a124b5a404b7254b9476104d8cce9b27189a642ecbeda2ffce8dca6cfc4d331cacbbc869a245e0b9766a40bf86f1e9c268d1e2b4d7221e5a82eeab4760
- SSDEEP
  
  3072:M4p9gmss0FvbVJznCRcz/hVFA9MSs/PLLj+Qm4U3YwgTeA3fQi:tovbfznH7O9G/PLLxU3YwgT
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence