28824f7006872c78d1914bb2bf95671f0033ee2b0aad19244447383dbe803a1e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28824f7006872c78d1914bb2bf95671f0033ee2b0aad19244447383dbe803a1e
Size

100KB
Sample

221127-bqfbxaaa45
MD5

5569861337f4a0447cbe1b0886a2dd04
SHA1

84034aa020f72e6dd6ef8849e386ae48ee83898b
SHA256

28824f7006872c78d1914bb2bf95671f0033ee2b0aad19244447383dbe803a1e
SHA512

65a28534d2e86541d03c8d333e383881ebe30332629ce4cb6e7f17a2682777af2d1c0b044fdfed748994d25fbf4ed90bd2e00f07262ece23e10bf6be8e65f40a
SSDEEP

1536:zD1RjS3Kj/HP1UtGgH0tCSoe11z3yqM4/0bucdU/mNYjiZcHvIyi68q7+FSlDKB0:vy3KbP1U1ju0Qz

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  28824f7006872c78d1914bb2bf95671f0033ee2b0aad19244447383dbe803a1e
- Size
  
  100KB
- MD5
  
  5569861337f4a0447cbe1b0886a2dd04
- SHA1
  
  84034aa020f72e6dd6ef8849e386ae48ee83898b
- SHA256
  
  28824f7006872c78d1914bb2bf95671f0033ee2b0aad19244447383dbe803a1e
- SHA512
  
  65a28534d2e86541d03c8d333e383881ebe30332629ce4cb6e7f17a2682777af2d1c0b044fdfed748994d25fbf4ed90bd2e00f07262ece23e10bf6be8e65f40a
- SSDEEP
  
  1536:zD1RjS3Kj/HP1UtGgH0tCSoe11z3yqM4/0bucdU/mNYjiZcHvIyi68q7+FSlDKB0:vy3KbP1U1ju0Qz
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence