c9317d927a5f9bf14eeb010c92048c3c6621ddb0e6e4d20ae991c836434e52cf | Triage

Sharing

General

Target

c9317d927a5f9bf14eeb010c92048c3c6621ddb0e6e4d20ae991c836434e52cf
Size

260KB
Sample

221124-ajax6see64
MD5

0193854481f436b0788620e419d472ef
SHA1

172be941a689a968e3387d89c5d98192de95a57a
SHA256

c9317d927a5f9bf14eeb010c92048c3c6621ddb0e6e4d20ae991c836434e52cf
SHA512

e413b1ca5fc790949d95349520d11d14099e18e7bf638a6be3da37201bad37aae9fb0167c270fe2cb61cd47544d6eb44b44c4335abf6b91e3c37be9193a4fbaa
SSDEEP

3072:QgfAlNvlvh25n/kZoSUjMqXnpWAkpAmTSrMaIOYt/jo7LAtPhjjtZnfHFEoWBfGl:QdsgTSrMaIl/jcLijfHFEHWzXvjT85R

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c9317d927a5f9bf14eeb010c92048c3c6621ddb0e6e4d20ae991c836434e52cf
- Size
  
  260KB
- MD5
  
  0193854481f436b0788620e419d472ef
- SHA1
  
  172be941a689a968e3387d89c5d98192de95a57a
- SHA256
  
  c9317d927a5f9bf14eeb010c92048c3c6621ddb0e6e4d20ae991c836434e52cf
- SHA512
  
  e413b1ca5fc790949d95349520d11d14099e18e7bf638a6be3da37201bad37aae9fb0167c270fe2cb61cd47544d6eb44b44c4335abf6b91e3c37be9193a4fbaa
- SSDEEP
  
  3072:QgfAlNvlvh25n/kZoSUjMqXnpWAkpAmTSrMaIOYt/jo7LAtPhjjtZnfHFEoWBfGl:QdsgTSrMaIl/jcLijfHFEHWzXvjT85R
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence