Overview

overview

10

Static

static

a989b68a28...bf.exe

windows7-x64

10

a989b68a28...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a989b68a28a988fbb53e6eb2f649fcf650f9836cb450a6e40901e304f7f41cbf

  • Size

    272KB

  • Sample

    221129-txd2jaef37

  • MD5

    5a738b5dea507591f8ea7cf696e7147a

  • SHA1

    ea607ac2073d400b8f085098975394e531be0414

  • SHA256

    a989b68a28a988fbb53e6eb2f649fcf650f9836cb450a6e40901e304f7f41cbf

  • SHA512

    40bb7e1136990abf9f18b6769608b60ff5a38637f790c7c31c19b12f7b2106296fe10d250009b8137690b47ed3a77ecff074684a08343e27b2239f07055768be

  • SSDEEP

    6144:gDCwfG1bnxLERRbUCTLtDv0jZ/wQFheRo9bA0f:g72bntELb9L9v0F/wQLeRo9r

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      a989b68a28a988fbb53e6eb2f649fcf650f9836cb450a6e40901e304f7f41cbf

    • Size

      272KB

    • MD5

      5a738b5dea507591f8ea7cf696e7147a

    • SHA1

      ea607ac2073d400b8f085098975394e531be0414

    • SHA256

      a989b68a28a988fbb53e6eb2f649fcf650f9836cb450a6e40901e304f7f41cbf

    • SHA512

      40bb7e1136990abf9f18b6769608b60ff5a38637f790c7c31c19b12f7b2106296fe10d250009b8137690b47ed3a77ecff074684a08343e27b2239f07055768be

    • SSDEEP

      6144:gDCwfG1bnxLERRbUCTLtDv0jZ/wQFheRo9bA0f:g72bntELb9L9v0F/wQLeRo9r

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks