af9a84f704a5f8d204d8c1f22812e974f0d8fdc1c49306a1d9a92b3202188747 | Triage

Sharing

General

Target

af9a84f704a5f8d204d8c1f22812e974f0d8fdc1c49306a1d9a92b3202188747
Size

1.5MB
Sample

221125-mp1f8sba96
MD5

209fc0c693845c861f7eadb44daf5d2a
SHA1

1bf683a633708b1a21ba659309edfca15f504201
SHA256

af9a84f704a5f8d204d8c1f22812e974f0d8fdc1c49306a1d9a92b3202188747
SHA512

12d6fb0b3a5390cf386ace065b1a9ab342050fa184af9f2dc1c676e9c36a6a14978c41923f89da1b3186d6e464d4f4c1da6ab06ab2c5de4c462defe8eb8b454e
SSDEEP

24576:Hpa/O74CNt3r2J2FC3eUldZUJ3OlKU4UDcc6Cy+9eGd:wcZC35VcOcmDcc6CdT

Score

7^/10

Malware Config

Targets

- Target
  
  af9a84f704a5f8d204d8c1f22812e974f0d8fdc1c49306a1d9a92b3202188747
- Size
  
  1.5MB
- MD5
  
  209fc0c693845c861f7eadb44daf5d2a
- SHA1
  
  1bf683a633708b1a21ba659309edfca15f504201
- SHA256
  
  af9a84f704a5f8d204d8c1f22812e974f0d8fdc1c49306a1d9a92b3202188747
- SHA512
  
  12d6fb0b3a5390cf386ace065b1a9ab342050fa184af9f2dc1c676e9c36a6a14978c41923f89da1b3186d6e464d4f4c1da6ab06ab2c5de4c462defe8eb8b454e
- SSDEEP
  
  24576:Hpa/O74CNt3r2J2FC3eUldZUJ3OlKU4UDcc6Cy+9eGd:wcZC35VcOcmDcc6CdT
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2