287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426 | Triage

Sharing

General

Target

287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426
Size

84KB
Sample

221125-x8cjmadb91
MD5

187ebed20ef31dbf7e7fe6fce1feb28e
SHA1

10f6959294838dd05cfca8760b65c1761cc9bd09
SHA256

287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426
SHA512

53b334b0918849e3eeffa1b748109298b4cd0154c97715275adb679decee33568d3e7b2390ca1353382e6f7eef2fb9a9028ad6418c22e43e214126bb7c55227f
SSDEEP

768:DyV+hOvo/OswzKvgO0jAIWi3KEyUhL7b7Yqlf4JwQltjmtTBHi7Alg:DoFvOyES76Ezh/vYlJwAitTB3lg

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426
- Size
  
  84KB
- MD5
  
  187ebed20ef31dbf7e7fe6fce1feb28e
- SHA1
  
  10f6959294838dd05cfca8760b65c1761cc9bd09
- SHA256
  
  287926c2dfe50f65eb1cc91e7cbfaf35c351b1fda564de262a6f07c835c92426
- SHA512
  
  53b334b0918849e3eeffa1b748109298b4cd0154c97715275adb679decee33568d3e7b2390ca1353382e6f7eef2fb9a9028ad6418c22e43e214126bb7c55227f
- SSDEEP
  
  768:DyV+hOvo/OswzKvgO0jAIWi3KEyUhL7b7Yqlf4JwQltjmtTBHi7Alg:DoFvOyES76Ezh/vYlJwAitTB3lg
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence