cef0ede8e923267d2e61c1c5322a4b9332c337aa41c2188019b44986f04224d8 | Triage

Sharing

General

Target

cef0ede8e923267d2e61c1c5322a4b9332c337aa41c2188019b44986f04224d8
Size

44KB
Sample

221124-asnkmafc24
MD5

35a2922d8c3d0fd4d3a6eb11bd1cbc60
SHA1

221bc7709074793eb2c17c54ff3bb08402af1501
SHA256

cef0ede8e923267d2e61c1c5322a4b9332c337aa41c2188019b44986f04224d8
SHA512

4600318e092e6d2a38c42401c5e38cde080a356a8cf8ccae7b9e2a7a330d844fb99a50c493e8bd298b50d47efe6fcf8f85858c91f9c0c2115783b6ca97527a53
SSDEEP

768:xh/Hdi9OLmOpXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:xTKOkHyj6S3T77

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  cef0ede8e923267d2e61c1c5322a4b9332c337aa41c2188019b44986f04224d8
- Size
  
  44KB
- MD5
  
  35a2922d8c3d0fd4d3a6eb11bd1cbc60
- SHA1
  
  221bc7709074793eb2c17c54ff3bb08402af1501
- SHA256
  
  cef0ede8e923267d2e61c1c5322a4b9332c337aa41c2188019b44986f04224d8
- SHA512
  
  4600318e092e6d2a38c42401c5e38cde080a356a8cf8ccae7b9e2a7a330d844fb99a50c493e8bd298b50d47efe6fcf8f85858c91f9c0c2115783b6ca97527a53
- SSDEEP
  
  768:xh/Hdi9OLmOpXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:xTKOkHyj6S3T77
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence