d9766231ed22b500eee9fac9cb58d392c4a2f2f2da12c8183d52fdc60f01c979 | Triage

Sharing

General

Target

d9766231ed22b500eee9fac9cb58d392c4a2f2f2da12c8183d52fdc60f01c979
Size

156KB
Sample

221201-2gzbjagg84
MD5

4608794fb0e055a5a0d8039a743a6a90
SHA1

5d354a58be0afdb15a2d77489333f360103cbf85
SHA256

d9766231ed22b500eee9fac9cb58d392c4a2f2f2da12c8183d52fdc60f01c979
SHA512

3ea00065dcd5407ddfc367d16d51dfdd0244a9089c3dba28d0ab8058535a9a69f5133402b599e44bf43124ffcfbd5ba4426ce634f92977cd72cf6b1c3871c78f
SSDEEP

3072:IxRndefUkuUx/loYl36iqlekwohWv6pcDordSB4oQZiERu:uJ+Uk/dlb+wohQxDomWK

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  d9766231ed22b500eee9fac9cb58d392c4a2f2f2da12c8183d52fdc60f01c979
- Size
  
  156KB
- MD5
  
  4608794fb0e055a5a0d8039a743a6a90
- SHA1
  
  5d354a58be0afdb15a2d77489333f360103cbf85
- SHA256
  
  d9766231ed22b500eee9fac9cb58d392c4a2f2f2da12c8183d52fdc60f01c979
- SHA512
  
  3ea00065dcd5407ddfc367d16d51dfdd0244a9089c3dba28d0ab8058535a9a69f5133402b599e44bf43124ffcfbd5ba4426ce634f92977cd72cf6b1c3871c78f
- SSDEEP
  
  3072:IxRndefUkuUx/loYl36iqlekwohWv6pcDordSB4oQZiERu:uJ+Uk/dlb+wohQxDomWK
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence