0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666 | Triage

Sharing

General

Target

0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666
Size

191KB
Sample

221126-2m44zaag43
MD5

6f204ac7e40d82963c7c1a1449acfea2
SHA1

36ab86149523ecd1dd6210285de9777c24ab3708
SHA256

0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666
SHA512

efacc891f4af15024af7127dc60b2907468bfc0cec6fbbf14505bb908bb987031c475e1d61447b451035650229b4172ebf3489f6bd786c7512b073e2dd10c14d
SSDEEP

3072:jiDZW9tCFUkd8nS5JTEc5f/xk9T+bcngp2h7XRNKhBlw/3f/gbAi3:jiI9thk2S5P5f/xk9T+wngcVeBIH8Ai

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666
- Size
  
  191KB
- MD5
  
  6f204ac7e40d82963c7c1a1449acfea2
- SHA1
  
  36ab86149523ecd1dd6210285de9777c24ab3708
- SHA256
  
  0ffc29f7463d4f00957d483a4a2d1841bddad5da3d1f243c5958ef5630928666
- SHA512
  
  efacc891f4af15024af7127dc60b2907468bfc0cec6fbbf14505bb908bb987031c475e1d61447b451035650229b4172ebf3489f6bd786c7512b073e2dd10c14d
- SSDEEP
  
  3072:jiDZW9tCFUkd8nS5JTEc5f/xk9T+bcngp2h7XRNKhBlw/3f/gbAi3:jiI9thk2S5P5f/xk9T+wngcVeBIH8Ai
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2