7b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738 | Triage

Sharing

General

Target

7b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738
Size

379KB
Sample

221125-jfyphaeh3z
MD5

d6ea81e78c57e02d4fd9f48544321988
SHA1

5da4748d0089fc7b0ff903e342e6f752c90388ba
SHA256

7b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738
SHA512

201d39632b62e5d40f1d4fd9c02a52347b2578500aea2277d3cfb6dcf18812fdb238796acf264046d6e19f076eb28f8a255c47ccdac34ac27ab1a04288d132f4
SSDEEP

3072:UMxniMB1K2STu8geS2DI4AinsWZHeHc1VR7:RxiOJSTse9D4k+Hi7

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  7b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738
- Size
  
  379KB
- MD5
  
  d6ea81e78c57e02d4fd9f48544321988
- SHA1
  
  5da4748d0089fc7b0ff903e342e6f752c90388ba
- SHA256
  
  7b977ffacdc7a59769d68bc3f021e80bb845c55214b61cc639b25cf558d92738
- SHA512
  
  201d39632b62e5d40f1d4fd9c02a52347b2578500aea2277d3cfb6dcf18812fdb238796acf264046d6e19f076eb28f8a255c47ccdac34ac27ab1a04288d132f4
- SSDEEP
  
  3072:UMxniMB1K2STu8geS2DI4AinsWZHeHc1VR7:RxiOJSTse9D4k+Hi7
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence