Overview

overview

8

Static

static

afbb067699...a4.exe

windows7-x64

8

afbb067699...a4.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    afbb067699fdd8f925ccca331977f6cbb75faa82062d3119bbcc6caac47530a4

  • Size

    296KB

  • Sample

    221125-h3d3yadh2t

  • MD5

    8618d11191d30a3a3ed955a9cace0e88

  • SHA1

    6ef8132d54261d94861722e9c6bfbfdbda9a42d1

  • SHA256

    afbb067699fdd8f925ccca331977f6cbb75faa82062d3119bbcc6caac47530a4

  • SHA512

    c9b515fa3466a02472328a40be79973e5af8beaba81870c9fb383a7d8eec041c1f83c479fd5c919f3f0bc627362da4774ac08f0402ea4a7c88da9e73f4c10ef1

  • SSDEEP

    6144:nmhXj+t+JcJKGi11ieCKtzFgyZAZAXlqHVTt:nmh+wkKGi6qcZAXlqf

Score
8/10
persistence

Malware Config

Targets

    • Target

      afbb067699fdd8f925ccca331977f6cbb75faa82062d3119bbcc6caac47530a4

    • Size

      296KB

    • MD5

      8618d11191d30a3a3ed955a9cace0e88

    • SHA1

      6ef8132d54261d94861722e9c6bfbfdbda9a42d1

    • SHA256

      afbb067699fdd8f925ccca331977f6cbb75faa82062d3119bbcc6caac47530a4

    • SHA512

      c9b515fa3466a02472328a40be79973e5af8beaba81870c9fb383a7d8eec041c1f83c479fd5c919f3f0bc627362da4774ac08f0402ea4a7c88da9e73f4c10ef1

    • SSDEEP

      6144:nmhXj+t+JcJKGi11ieCKtzFgyZAZAXlqHVTt:nmh+wkKGi6qcZAXlqf

    Score
    8/10
    persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks for any installed AV software in registry

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Security Software Discovery

1
T1063

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks