e2eaf581fc8203ecb83ca24370d94a649bf95b17413e618c6cf1f524bf998d93 | Triage

Sharing

General

Target

e2eaf581fc8203ecb83ca24370d94a649bf95b17413e618c6cf1f524bf998d93
Size

88KB
Sample

221203-n3y11agf85
MD5

618c00b3a0ec864695947bf0cd304090
SHA1

267d3139af64f478d9e4ae998c7f08645ed495e6
SHA256

e2eaf581fc8203ecb83ca24370d94a649bf95b17413e618c6cf1f524bf998d93
SHA512

995726d5b463af3f85009ea3775931cc528309089318284acf5e0db6f7bf3c4263d7c7df0e7b12f3747c786f90093d467be01fbe44d9b208aa16c356b6fad583
SSDEEP

1536:plTYNMg4l3gJpEer9+wEDFcemSMuiJibg5ix76X41V8xkS/:kNM3l3gJpESUBc9SM1Jagw76XA8Go

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  e2eaf581fc8203ecb83ca24370d94a649bf95b17413e618c6cf1f524bf998d93
- Size
  
  88KB
- MD5
  
  618c00b3a0ec864695947bf0cd304090
- SHA1
  
  267d3139af64f478d9e4ae998c7f08645ed495e6
- SHA256
  
  e2eaf581fc8203ecb83ca24370d94a649bf95b17413e618c6cf1f524bf998d93
- SHA512
  
  995726d5b463af3f85009ea3775931cc528309089318284acf5e0db6f7bf3c4263d7c7df0e7b12f3747c786f90093d467be01fbe44d9b208aa16c356b6fad583
- SSDEEP
  
  1536:plTYNMg4l3gJpEer9+wEDFcemSMuiJibg5ix76X41V8xkS/:kNM3l3gJpESUBc9SM1Jagw76XA8Go
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence