Overview

overview

10

Static

static

d5614ce395...eb.exe

windows7-x64

10

d5614ce395...eb.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d5614ce395cf60b119290af388589d8a84d1be4f835a3aa52074661403a61ceb

  • Size

    707KB

  • Sample

    221129-twftqsee74

  • MD5

    5f56f24a6e2fc2b393e4eaa9c8a43699

  • SHA1

    64f2c16f6bf8d28005f85b64d6d13150ce062e37

  • SHA256

    d5614ce395cf60b119290af388589d8a84d1be4f835a3aa52074661403a61ceb

  • SHA512

    da2a4b21c0d9f91b3f7b70b2c087de545afc5fe9882b9c46b6fd3325f7aad69ddbe295469641eb7cb1655497c9be8c8babf9c2876ca8b2bdde22664011f4fa8e

  • SSDEEP

    12288:g72bntEDs72bntEDW72bntEDs72bntEDCG1T:g72zms72zmW72zms72zmCs

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      d5614ce395cf60b119290af388589d8a84d1be4f835a3aa52074661403a61ceb

    • Size

      707KB

    • MD5

      5f56f24a6e2fc2b393e4eaa9c8a43699

    • SHA1

      64f2c16f6bf8d28005f85b64d6d13150ce062e37

    • SHA256

      d5614ce395cf60b119290af388589d8a84d1be4f835a3aa52074661403a61ceb

    • SHA512

      da2a4b21c0d9f91b3f7b70b2c087de545afc5fe9882b9c46b6fd3325f7aad69ddbe295469641eb7cb1655497c9be8c8babf9c2876ca8b2bdde22664011f4fa8e

    • SSDEEP

      12288:g72bntEDs72bntEDW72bntEDs72bntEDCG1T:g72zms72zmW72zms72zmCs

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks