1f0940d486100ee8c3598f7f2ed7d3d1f25dc2993daed1081ffead5844a62c77 | Triage

Sharing

General

Target

1f0940d486100ee8c3598f7f2ed7d3d1f25dc2993daed1081ffead5844a62c77
Size

80KB
Sample

221124-aqgz3afa83
MD5

35128e0afdeb32bc46ed472905196147
SHA1

c64812e1d01d856a8968a20739129ea352f5b81c
SHA256

1f0940d486100ee8c3598f7f2ed7d3d1f25dc2993daed1081ffead5844a62c77
SHA512

4a9214b29cf6a4e5e70fe983ab2a1f3ad47ba922b39b562923778e9f584922957c02a52620bde0c439e3b281fb837f486afc365774fc82f90bde331967ebdf94
SSDEEP

1536:tDwzKuOzj4i7GNetv6lTwDkJY7vyQdGV4Kj:VT+lTwDkJEDGFj

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  1f0940d486100ee8c3598f7f2ed7d3d1f25dc2993daed1081ffead5844a62c77
- Size
  
  80KB
- MD5
  
  35128e0afdeb32bc46ed472905196147
- SHA1
  
  c64812e1d01d856a8968a20739129ea352f5b81c
- SHA256
  
  1f0940d486100ee8c3598f7f2ed7d3d1f25dc2993daed1081ffead5844a62c77
- SHA512
  
  4a9214b29cf6a4e5e70fe983ab2a1f3ad47ba922b39b562923778e9f584922957c02a52620bde0c439e3b281fb837f486afc365774fc82f90bde331967ebdf94
- SSDEEP
  
  1536:tDwzKuOzj4i7GNetv6lTwDkJY7vyQdGV4Kj:VT+lTwDkJEDGFj
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence