7e725c28588cbe681d1dd9b5c5b54225447b94787dd47e6e305cc3ba80cfe2d5 | Triage

Sharing

General

Target

7e725c28588cbe681d1dd9b5c5b54225447b94787dd47e6e305cc3ba80cfe2d5
Size

43KB
Sample

221127-tbx8aade3z
MD5

6a6fda277813b5dbb8b30d47db84dd37
SHA1

9acb5932d932e4c0047de6ceab891dac93b27b02
SHA256

7e725c28588cbe681d1dd9b5c5b54225447b94787dd47e6e305cc3ba80cfe2d5
SHA512

6a27cc26048e625e3510a200dfdcc3c72ac75265f9bfae6f8e835bfd81577bb17159f42ee3a79589ebe2dea89d83877be43a0b19d4ed63d33ff256df07eee786
SSDEEP

768:vUdNT8uX2d5SogqD0rK9GTW2Es5E1v6HatjHX8qvtG1GlIL19x2N/UT6HCCjPkan:o6GvUmaxTitj2xHCCrk

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  7e725c28588cbe681d1dd9b5c5b54225447b94787dd47e6e305cc3ba80cfe2d5
- Size
  
  43KB
- MD5
  
  6a6fda277813b5dbb8b30d47db84dd37
- SHA1
  
  9acb5932d932e4c0047de6ceab891dac93b27b02
- SHA256
  
  7e725c28588cbe681d1dd9b5c5b54225447b94787dd47e6e305cc3ba80cfe2d5
- SHA512
  
  6a27cc26048e625e3510a200dfdcc3c72ac75265f9bfae6f8e835bfd81577bb17159f42ee3a79589ebe2dea89d83877be43a0b19d4ed63d33ff256df07eee786
- SSDEEP
  
  768:vUdNT8uX2d5SogqD0rK9GTW2Es5E1v6HatjHX8qvtG1GlIL19x2N/UT6HCCjPkan:o6GvUmaxTitj2xHCCrk
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence