a591d2628783ceb7fcf2333870324e464451a838ae2878a4667357718a110abd | Triage

Sharing

General

Target

a591d2628783ceb7fcf2333870324e464451a838ae2878a4667357718a110abd
Size

88KB
Sample

221201-2yr9jsac82
MD5

5d66df5aad51b1f2ec533983f9915852
SHA1

46b2a4fffa7f3c3a3c008c6e487c742ea3184031
SHA256

a591d2628783ceb7fcf2333870324e464451a838ae2878a4667357718a110abd
SHA512

f7aa23af00ecb87ac9fd41d743eb0af2daa8ccd8e05e1933cefd349ddeda4945f9bff35145eef96915b47b09f99f2c5d445564d9a2b68c9d77a1a029947ec4d4
SSDEEP

768:7Lk9rFEGNu34C/lfQzxKztTp8KS5k+qIYvCdUwY7EqVN14+QCnq/K/7ZP:7LksGGloAztd8HtPY7DN14Oqi/7ZP

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  a591d2628783ceb7fcf2333870324e464451a838ae2878a4667357718a110abd
- Size
  
  88KB
- MD5
  
  5d66df5aad51b1f2ec533983f9915852
- SHA1
  
  46b2a4fffa7f3c3a3c008c6e487c742ea3184031
- SHA256
  
  a591d2628783ceb7fcf2333870324e464451a838ae2878a4667357718a110abd
- SHA512
  
  f7aa23af00ecb87ac9fd41d743eb0af2daa8ccd8e05e1933cefd349ddeda4945f9bff35145eef96915b47b09f99f2c5d445564d9a2b68c9d77a1a029947ec4d4
- SSDEEP
  
  768:7Lk9rFEGNu34C/lfQzxKztTp8KS5k+qIYvCdUwY7EqVN14+QCnq/K/7ZP:7LksGGloAztd8HtPY7DN14Oqi/7ZP
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence