bffc2262e430fd4be79f108607e57c774aa854492e4ba821f322b33b4fbac81d | Triage

Sharing

General

Target

bffc2262e430fd4be79f108607e57c774aa854492e4ba821f322b33b4fbac81d
Size

585KB
Sample

221127-vnqveahc3s
MD5

aa250d21c37e4dcda9a10049c1d9ba0f
SHA1

97a5a3120d7906cace5fefc825395df94b21f5e8
SHA256

bffc2262e430fd4be79f108607e57c774aa854492e4ba821f322b33b4fbac81d
SHA512

c99023ba28f40f1cbae380157ecc11b4c9ff6960791f2cb2dc66b451cb4a967853fccbb8a647ce068874d66c9c80dab1c66f93af401ad1679b8cd7c5b94d8306
SSDEEP

6144:ZL1UZrXrLWx85SvvE7pjYFoqphjsjwoHlppHo32:Fx8gm

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  bffc2262e430fd4be79f108607e57c774aa854492e4ba821f322b33b4fbac81d
- Size
  
  585KB
- MD5
  
  aa250d21c37e4dcda9a10049c1d9ba0f
- SHA1
  
  97a5a3120d7906cace5fefc825395df94b21f5e8
- SHA256
  
  bffc2262e430fd4be79f108607e57c774aa854492e4ba821f322b33b4fbac81d
- SHA512
  
  c99023ba28f40f1cbae380157ecc11b4c9ff6960791f2cb2dc66b451cb4a967853fccbb8a647ce068874d66c9c80dab1c66f93af401ad1679b8cd7c5b94d8306
- SSDEEP
  
  6144:ZL1UZrXrLWx85SvvE7pjYFoqphjsjwoHlppHo32:Fx8gm
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence