79784f69f902f7afd45c080ed70b7e861b9ad1b2a88798ccc91421e5ce969783 | Triage

Sharing

General

Target

79784f69f902f7afd45c080ed70b7e861b9ad1b2a88798ccc91421e5ce969783
Size

276KB
Sample

221202-axcc6aah9t
MD5

50c4998878e39bd2ec3999d925369034
SHA1

7f866cd137fdcc2dad7535f1d041dd1d6e1324b3
SHA256

79784f69f902f7afd45c080ed70b7e861b9ad1b2a88798ccc91421e5ce969783
SHA512

96306ebc010bb597e66142bf8c8cbc68baf0e11063544cd3b515da61a1c395245bfa6f310d76e4b4d42ca50a4504cdba2c5f36b8b68c61e0ecd0e1658c4fd1eb
SSDEEP

3072:0fvtsFVUvzaqBwEQslNTl8Kmmo4xTbWI+QV7irN/qxn8UAeBuUBce5m:EtwExplrxbWI+rNSBtdFceo

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  79784f69f902f7afd45c080ed70b7e861b9ad1b2a88798ccc91421e5ce969783
- Size
  
  276KB
- MD5
  
  50c4998878e39bd2ec3999d925369034
- SHA1
  
  7f866cd137fdcc2dad7535f1d041dd1d6e1324b3
- SHA256
  
  79784f69f902f7afd45c080ed70b7e861b9ad1b2a88798ccc91421e5ce969783
- SHA512
  
  96306ebc010bb597e66142bf8c8cbc68baf0e11063544cd3b515da61a1c395245bfa6f310d76e4b4d42ca50a4504cdba2c5f36b8b68c61e0ecd0e1658c4fd1eb
- SSDEEP
  
  3072:0fvtsFVUvzaqBwEQslNTl8Kmmo4xTbWI+QV7irN/qxn8UAeBuUBce5m:EtwExplrxbWI+rNSBtdFceo
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence