a071ccc8ff423399e5ed3ebee624a94cc34320733979c27ebca642863ce643fb | Triage

Sharing

General

Target

a071ccc8ff423399e5ed3ebee624a94cc34320733979c27ebca642863ce643fb
Size

220KB
Sample

221129-d6re8afb9z
MD5

e90b745c778cec128f9d417fabf77cdc
SHA1

8ab69032568673c40f4ee2d1f5b5ced734f0459f
SHA256

a071ccc8ff423399e5ed3ebee624a94cc34320733979c27ebca642863ce643fb
SHA512

1e61a2804cc104b1e404e49593a20a2c4fa1062f734f1eefd966b6999ecf0eddad749b781419b88e99b38d79d9eb5bd9a509dda97d7c349ed306ba51b528ae1e
SSDEEP

3072:0+Ougkr8YUL4qx9RIHgil3UuhSa3U3dD8d6Oy+MIrnj3J+NB:VORko15x9SHVeOj0

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  a071ccc8ff423399e5ed3ebee624a94cc34320733979c27ebca642863ce643fb
- Size
  
  220KB
- MD5
  
  e90b745c778cec128f9d417fabf77cdc
- SHA1
  
  8ab69032568673c40f4ee2d1f5b5ced734f0459f
- SHA256
  
  a071ccc8ff423399e5ed3ebee624a94cc34320733979c27ebca642863ce643fb
- SHA512
  
  1e61a2804cc104b1e404e49593a20a2c4fa1062f734f1eefd966b6999ecf0eddad749b781419b88e99b38d79d9eb5bd9a509dda97d7c349ed306ba51b528ae1e
- SSDEEP
  
  3072:0+Ougkr8YUL4qx9RIHgil3UuhSa3U3dD8d6Oy+MIrnj3J+NB:VORko15x9SHVeOj0
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence