3edfca92f937a2516599fba8ee3a9671a3d887b10eb9670f5fc0d1371a439075 | Triage

Sharing

General

Target

3edfca92f937a2516599fba8ee3a9671a3d887b10eb9670f5fc0d1371a439075
Size

112KB
Sample

221124-apq7caab7z
MD5

37fd36aef8ff9bea1bd247ab639ae300
SHA1

75c1d23397b3503e9a88b7bf2c3e0b5d5bc1ce0c
SHA256

3edfca92f937a2516599fba8ee3a9671a3d887b10eb9670f5fc0d1371a439075
SHA512

bb20419bc0e4ec13511eb60db6674c19776b1b7037bc8de2442e79fb60606cf4002bc5c5efbe2a2a034057225fdd129e400f8280a6365fa3234b8a98d4277e1d
SSDEEP

1536:HfwdiIigE6eXTzQ+64OM2OMATZgJ6rMhe6rWhA3KaHmKq7I8kIi/uz:odQ6eXo+TrMhe6rM7rxz

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  3edfca92f937a2516599fba8ee3a9671a3d887b10eb9670f5fc0d1371a439075
- Size
  
  112KB
- MD5
  
  37fd36aef8ff9bea1bd247ab639ae300
- SHA1
  
  75c1d23397b3503e9a88b7bf2c3e0b5d5bc1ce0c
- SHA256
  
  3edfca92f937a2516599fba8ee3a9671a3d887b10eb9670f5fc0d1371a439075
- SHA512
  
  bb20419bc0e4ec13511eb60db6674c19776b1b7037bc8de2442e79fb60606cf4002bc5c5efbe2a2a034057225fdd129e400f8280a6365fa3234b8a98d4277e1d
- SSDEEP
  
  1536:HfwdiIigE6eXTzQ+64OM2OMATZgJ6rMhe6rWhA3KaHmKq7I8kIi/uz:odQ6eXo+TrMhe6rM7rxz
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence