9a350976bea2a77b75c6021816ba8a1fd06710bb2b65f7a6cf5dcbf3c306600c | Triage

Sharing

General

Target

9a350976bea2a77b75c6021816ba8a1fd06710bb2b65f7a6cf5dcbf3c306600c
Size

88KB
Sample

221201-2cfnmagc87
MD5

066d6f3188fe501d3d2295b51fd65c30
SHA1

cb13bb51a2d1c6243b419379954b0743cfb4426a
SHA256

9a350976bea2a77b75c6021816ba8a1fd06710bb2b65f7a6cf5dcbf3c306600c
SHA512

7d320696b3ec8ca888e87f0136d33e75bf8206021e3128d3113d5a59d07381c64fc312ee5aa2f1b1d72b6d8db8ca2bb577c504f6fd96a62e1bcbcd447552891f
SSDEEP

768:IQb6o5nnURLQ/JD60XDeVtA5YxmHwWW2iYf/ce2NZQcyfbdg5CIBT/DCwaTDNmfZ:IKnIQ/JDHKa5LJW6/Z2NZQCvDmNmopA

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  9a350976bea2a77b75c6021816ba8a1fd06710bb2b65f7a6cf5dcbf3c306600c
- Size
  
  88KB
- MD5
  
  066d6f3188fe501d3d2295b51fd65c30
- SHA1
  
  cb13bb51a2d1c6243b419379954b0743cfb4426a
- SHA256
  
  9a350976bea2a77b75c6021816ba8a1fd06710bb2b65f7a6cf5dcbf3c306600c
- SHA512
  
  7d320696b3ec8ca888e87f0136d33e75bf8206021e3128d3113d5a59d07381c64fc312ee5aa2f1b1d72b6d8db8ca2bb577c504f6fd96a62e1bcbcd447552891f
- SSDEEP
  
  768:IQb6o5nnURLQ/JD60XDeVtA5YxmHwWW2iYf/ce2NZQcyfbdg5CIBT/DCwaTDNmfZ:IKnIQ/JDHKa5LJW6/Z2NZQCvDmNmopA
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence