1aad69ee54d5a147e840f06f395fd08fbb4b153abdffec61312b3fd65cbb5959 | Triage

Sharing

General

Target

1aad69ee54d5a147e840f06f395fd08fbb4b153abdffec61312b3fd65cbb5959
Size

112KB
Sample

221126-21z26sbg44
MD5

0c12db481a4bea637d6114e4c827d78f
SHA1

9ddfc714e1856c72a0f2316e8e24b04c8d73019b
SHA256

1aad69ee54d5a147e840f06f395fd08fbb4b153abdffec61312b3fd65cbb5959
SHA512

9f291181731876457f1d798fae8ed300176dae810d758e9de166d4dcfd9abb9cd34cf642864bfe724b414cc96574691c17994e6a3684e17858816709a0641f9a
SSDEEP

3072:7yxKG8MvlJlfkX9kXWqgkXAkXAkXAkXtkX8kXQkXhkXIkX/kXdkX+kXmkXJkXMkz:7yxKGnZkX9kXWqgkXAkXAkXAkXtkX8k1

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  1aad69ee54d5a147e840f06f395fd08fbb4b153abdffec61312b3fd65cbb5959
- Size
  
  112KB
- MD5
  
  0c12db481a4bea637d6114e4c827d78f
- SHA1
  
  9ddfc714e1856c72a0f2316e8e24b04c8d73019b
- SHA256
  
  1aad69ee54d5a147e840f06f395fd08fbb4b153abdffec61312b3fd65cbb5959
- SHA512
  
  9f291181731876457f1d798fae8ed300176dae810d758e9de166d4dcfd9abb9cd34cf642864bfe724b414cc96574691c17994e6a3684e17858816709a0641f9a
- SSDEEP
  
  3072:7yxKG8MvlJlfkX9kXWqgkXAkXAkXAkXtkX8kXQkXhkXIkX/kXdkX+kXmkXJkXMkz:7yxKGnZkX9kXWqgkXAkXAkXAkXtkX8k1
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence