aa7dc64bfbd68141c4085daf6a3eb2d32242640974e12f1a56a862c295916574 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aa7dc64bfbd68141c4085daf6a3eb2d32242640974e12f1a56a862c295916574
Size

200KB
Sample

221129-vvklzace7z
MD5

0166573c66284a670ebf7364dd185974
SHA1

ce4b5657877ae74ecf9a4b704c4c8842a7f2f322
SHA256

aa7dc64bfbd68141c4085daf6a3eb2d32242640974e12f1a56a862c295916574
SHA512

405e5aabf294a3f031347b110e12771ae73d81c010ef884fd22fcb9b818bfcbcb8715a09ca91dba7da948c2ffe4b9a7216afeb3b60e0d93478a41f83dd040b42
SSDEEP

6144:jmxepWymPBeaSAOJ+7xi5eRed63qaCR8nIBKa:yxiLmPBeaSAOJ+7xi5eRed63qaCD

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  aa7dc64bfbd68141c4085daf6a3eb2d32242640974e12f1a56a862c295916574
- Size
  
  200KB
- MD5
  
  0166573c66284a670ebf7364dd185974
- SHA1
  
  ce4b5657877ae74ecf9a4b704c4c8842a7f2f322
- SHA256
  
  aa7dc64bfbd68141c4085daf6a3eb2d32242640974e12f1a56a862c295916574
- SHA512
  
  405e5aabf294a3f031347b110e12771ae73d81c010ef884fd22fcb9b818bfcbcb8715a09ca91dba7da948c2ffe4b9a7216afeb3b60e0d93478a41f83dd040b42
- SSDEEP
  
  6144:jmxepWymPBeaSAOJ+7xi5eRed63qaCR8nIBKa:yxiLmPBeaSAOJ+7xi5eRed63qaCD
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence