7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07
Size

92KB
Sample

221127-vh7kzadc69
MD5

31235ae9502be65fd5c482d6df1fd46f
SHA1

40e5d08545af0e3e0858bedfbfc4dfa2eec8290c
SHA256

7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07
SHA512

d4723bc532083c495f3c1c8207c3e090ae0fcef50e8e93d1a621d3d310b57a954cceea855382ceaf2affc1987055cdc00c4818a92681800ea103cb3e77dc983e
SSDEEP

1536:yIM1yFwNHOcPNMt16a06VxDrIak9K0oBDPrzKJ:yZMtkgVxD708jzKJ

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07
- Size
  
  92KB
- MD5
  
  31235ae9502be65fd5c482d6df1fd46f
- SHA1
  
  40e5d08545af0e3e0858bedfbfc4dfa2eec8290c
- SHA256
  
  7c30532b0b180d0d44eada6f00d90140bde2c6d8a6b5d17c4ce3316c42205e07
- SHA512
  
  d4723bc532083c495f3c1c8207c3e090ae0fcef50e8e93d1a621d3d310b57a954cceea855382ceaf2affc1987055cdc00c4818a92681800ea103cb3e77dc983e
- SSDEEP
  
  1536:yIM1yFwNHOcPNMt16a06VxDrIak9K0oBDPrzKJ:yZMtkgVxD708jzKJ
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2