294516238c582814f1a6e751622246f1bf9010691218c0c581848338b5d9e275 | Triage

Sharing

General

Target

294516238c582814f1a6e751622246f1bf9010691218c0c581848338b5d9e275
Size

96KB
Sample

221124-agzthshf7w
MD5

3b5bca6d027cb1c9559b683f2b7279a6
SHA1

3ed2d4f472206dedbb9d5798980fd8523eff4f29
SHA256

294516238c582814f1a6e751622246f1bf9010691218c0c581848338b5d9e275
SHA512

696a072e4ba982959c36f6086f4cf3abb598ea67387eb221f1d25d68799335a96a03dfdf1330c9561466c5fddb2c2b9128c4803d1c607c7432b6fb1d7f83b9cd
SSDEEP

1536:TZEg52AbtyVQO8PXychnwjj3RJEEo/k3gzinynEkRldUEPjlijOezNIjnZ4B:dE/AUOychqzRqEkMCRld8zCnKB

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  294516238c582814f1a6e751622246f1bf9010691218c0c581848338b5d9e275
- Size
  
  96KB
- MD5
  
  3b5bca6d027cb1c9559b683f2b7279a6
- SHA1
  
  3ed2d4f472206dedbb9d5798980fd8523eff4f29
- SHA256
  
  294516238c582814f1a6e751622246f1bf9010691218c0c581848338b5d9e275
- SHA512
  
  696a072e4ba982959c36f6086f4cf3abb598ea67387eb221f1d25d68799335a96a03dfdf1330c9561466c5fddb2c2b9128c4803d1c607c7432b6fb1d7f83b9cd
- SSDEEP
  
  1536:TZEg52AbtyVQO8PXychnwjj3RJEEo/k3gzinynEkRldUEPjlijOezNIjnZ4B:dE/AUOychqzRqEkMCRld8zCnKB
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence