471ae3d0badd70c95a7dc4e9db4ce001544281e1f6bbcf94131395fcebaa29d5 | Triage

Submit
Reports

Overview

overview

8

Static

static

471ae3d0ba...d5.exe

windows7-x64

8

471ae3d0ba...d5.exe

windows10-2004-x64

8

Sharing

General

Target

471ae3d0badd70c95a7dc4e9db4ce001544281e1f6bbcf94131395fcebaa29d5
Size

3.3MB
Sample

221124-rx7mqsag77
MD5

7cecb5db02e0bb266129e849f42e3499
SHA1

50d638d25f22c8199a3cb552ee985cdf9c0c21be
SHA256

471ae3d0badd70c95a7dc4e9db4ce001544281e1f6bbcf94131395fcebaa29d5
SHA512

37082ffff09ac0eb13fad4cd10ba292e67868f09fb6e609b6d1338789e7af71b44f675e39c656b7e03436008931109fae8579b381182c70aa32c55d2c347ef88
SSDEEP

49152:kXEPcE6MUj3cbEMxh1FuLZ3ggxNwvCUAT+0862XysaffpEecjtXHWlQ2JgoY9fNA:iE6MVEMn1cLWgMKUYVsABYoaoY5yia

Score

8^/10

discovery persistence

Static task

static1

Behavioral task

behavioral1

Sample

471ae3d0badd70c95a7dc4e9db4ce001544281e1f6bbcf94131395fcebaa29d5.exe

Resource

win7-20220812-en

discovery persistence

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

471ae3d0badd70c95a7dc4e9db4ce001544281e1f6bbcf94131395fcebaa29d5.exe

Resource

win10v2004-20220901-en

discovery persistence

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  471ae3d0badd70c95a7dc4e9db4ce001544281e1f6bbcf94131395fcebaa29d5
- Size
  
  3.3MB
- MD5
  
  7cecb5db02e0bb266129e849f42e3499
- SHA1
  
  50d638d25f22c8199a3cb552ee985cdf9c0c21be
- SHA256
  
  471ae3d0badd70c95a7dc4e9db4ce001544281e1f6bbcf94131395fcebaa29d5
- SHA512
  
  37082ffff09ac0eb13fad4cd10ba292e67868f09fb6e609b6d1338789e7af71b44f675e39c656b7e03436008931109fae8579b381182c70aa32c55d2c347ef88
- SSDEEP
  
  49152:kXEPcE6MUj3cbEMxh1FuLZ3ggxNwvCUAT+0862XysaffpEecjtXHWlQ2JgoY9fNA:iE6MVEMn1cLWgMKUYVsABYoaoY5yia
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence

© 2018-2024

Terms | Privacy