c0aff43fc8a34cf8d2ef508e49597d552a80af10eb27e866e371abb8402197ca | Triage

Sharing

General

Target

c0aff43fc8a34cf8d2ef508e49597d552a80af10eb27e866e371abb8402197ca
Size

224KB
Sample

221201-2pcshahd96
MD5

1072cb754be102811c45d2ac3bcbf9fc
SHA1

0b58e35f6f51c4f76566d55e03f671ed2c211e95
SHA256

c0aff43fc8a34cf8d2ef508e49597d552a80af10eb27e866e371abb8402197ca
SHA512

faec34b86de29592221fd80332a08bd79e73d2f45dc713648a4a507842727fcdda9f028b3c9d54c53403273d7b7ce8b12120777983c05f8fe2c2da95179a1221
SSDEEP

3072:Sro4sUW1bU4SmOLCxokVq2pt91IrnXHTmchf8Yr7Br2C9fDcB/yX/4UlrIz:Sr9PhmOLm/42n91MnXHTmchfI/yX/4V

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c0aff43fc8a34cf8d2ef508e49597d552a80af10eb27e866e371abb8402197ca
- Size
  
  224KB
- MD5
  
  1072cb754be102811c45d2ac3bcbf9fc
- SHA1
  
  0b58e35f6f51c4f76566d55e03f671ed2c211e95
- SHA256
  
  c0aff43fc8a34cf8d2ef508e49597d552a80af10eb27e866e371abb8402197ca
- SHA512
  
  faec34b86de29592221fd80332a08bd79e73d2f45dc713648a4a507842727fcdda9f028b3c9d54c53403273d7b7ce8b12120777983c05f8fe2c2da95179a1221
- SSDEEP
  
  3072:Sro4sUW1bU4SmOLCxokVq2pt91IrnXHTmchf8Yr7Br2C9fDcB/yX/4UlrIz:Sr9PhmOLm/42n91MnXHTmchfI/yX/4V
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence