65c48916f5064ae60758ee43c0e4f65796facdf5e9f6e054c6ef841fd923ed9d | Triage

Sharing

General

Target

65c48916f5064ae60758ee43c0e4f65796facdf5e9f6e054c6ef841fd923ed9d
Size

86KB
Sample

221202-wc1e5sdf5y
MD5

ed603e6c1d92ad5431271448ee2a2dd5
SHA1

4080290225756c0b7c426db83bb38ce8c88211b1
SHA256

65c48916f5064ae60758ee43c0e4f65796facdf5e9f6e054c6ef841fd923ed9d
SHA512

145a30a6cc78a68cb166ca6f019204d984f3626a8944c1e9ea0910ca6a50e9d73bb4a58001528957f5d3347fcaf4242c233d6bf8715bb8245d867290e9f39744
SSDEEP

1536:rQwHfvMS0xcGxFyhQkrnb1Mq9WbYdpA+UD5Xb+xzzlgVrOre4pUi8OgfRG:rnHXMpxcGxFyhQ0bOqYM7TU5b+dp2rCh

Score

8^/10

Malware Config

Targets

- Target
  
  PHOTO-DEVOCHKA.exe
- Size
  
  180KB
- MD5
  
  36811975c8783184baa4c6b52e9ef020
- SHA1
  
  d58d15a044498dd031c0dbd0df2d1b11dda68375
- SHA256
  
  676e6244d7bb1fe69ab533cbad20f3c0cc57f951041d81d91e445fd726ff57f6
- SHA512
  
  c9777f95b32240bb8bec608e28e4cbbea4a40233b5409ef6bd508b5f91df8bfd512315db54c642a4807fed0c38ee629f704a10b0d1aea2499a0092c7db381cd9
- SSDEEP
  
  3072:NBAp5XhKpN4eOyVTGfhEClj8jTk+0hfAWFmEeQqqqqqqqqo/9:IbXE9OiTGfhEClq9K9Q
Score

8^/10
- Blocklisted process makes network request
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2