a630695fa734022ecb859d6cb6932b1f683f575a94b2193c4bac635673943249 | Triage

Sharing

General

Target

a630695fa734022ecb859d6cb6932b1f683f575a94b2193c4bac635673943249
Size

17KB
Sample

221124-z2twfaac27
MD5

8512b6c5f04b5c56b6e7c951f6b6a0ee
SHA1

f6328f06a854c040bed634c4c55328ceda17aa3a
SHA256

a630695fa734022ecb859d6cb6932b1f683f575a94b2193c4bac635673943249
SHA512

7f4f185f0e2b60055ba9041ac63d05946b6ab2169c08b70d180432786027f70f8c92ea55553b0d793e4908edf89c813a19e8442712a1c887047ea31e98aad90d
SSDEEP

384:TM0c5lhOrcjhVEqW8QstLCItZ8ro0KbRx1SWnUMCAyjDKO9oGm:A0cnxjHEtu3n8Udx1SWkKA6

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  gpa_cal.exe
- Size
  
  43KB
- MD5
  
  4e05534f1b1a17eea6e372ef1abd735e
- SHA1
  
  5a93caa8a184b56afd6d7569b1b049d908ea7c17
- SHA256
  
  976f0eab8e1394dcecd01ab989d26ccf9fc383c1c91acc0a7530348d5c5b759a
- SHA512
  
  262b6e6d2fd58302fcbc54ae51ef3d78d118cd74ab4bd783c5af063df04a672160fe0e5d8e274fe0a4e9a17aa0c4fd301203e1303c2c0ae51aa25e2ffcd37824
- SSDEEP
  
  768:XAyNMrbxn9kXhFVzrzkOUIAewWxk8VhTqDgCqo:QymgFxkExTVhoq
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence