Overview

overview

8

Static

static

000bf37f7b...0e.exe

windows7-x64

8

000bf37f7b...0e.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e

  • Size

    462KB

  • Sample

    221124-l8dwxaag5y

  • MD5

    de8e42d6fcf6317889264fd8ac46331d

  • SHA1

    94d2f603504332f7330cc4032adea18d93bc2ee3

  • SHA256

    000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e

  • SHA512

    a31ca15e31f56cb0110a11821cde008da58ce62a5a4f6c7c742867987d42b7426ea63bb609632eacedb0b744152d3ab914bdeeeb287cfddff41801d3ed92b50a

  • SSDEEP

    12288:MHX57zl29a/kCGZ+qFZhWUB3eTq3s0BFBs2:m57x29AujWUBj3TBFB

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e

    • Size

      462KB

    • MD5

      de8e42d6fcf6317889264fd8ac46331d

    • SHA1

      94d2f603504332f7330cc4032adea18d93bc2ee3

    • SHA256

      000bf37f7b42976de72f88d286641b09d6d8b6d766df8989abb084242f56fa0e

    • SHA512

      a31ca15e31f56cb0110a11821cde008da58ce62a5a4f6c7c742867987d42b7426ea63bb609632eacedb0b744152d3ab914bdeeeb287cfddff41801d3ed92b50a

    • SSDEEP

      12288:MHX57zl29a/kCGZ+qFZhWUB3eTq3s0BFBs2:m57x29AujWUBj3TBFB

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks