ce6372568979579c7c2873764640f0c89ec148ac0a84df8c7c1125b0c048273f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce6372568979579c7c2873764640f0c89ec148ac0a84df8c7c1125b0c048273f
Size

42KB
Sample

221203-p13f3sbf64
MD5

86c1355192609a9ec1333b27a5b5a186
SHA1

83233600c09fad1aeb3a9a0faa5e0a8d5ca0ee24
SHA256

ce6372568979579c7c2873764640f0c89ec148ac0a84df8c7c1125b0c048273f
SHA512

04547599f7561c35a83abb69e348bb8c7623a1189b32dc7b664eebc5a4a7186b2252de1a409ec5557290d444994f7b9c1840742f6813f0cab058443ddde4a9e3
SSDEEP

768:MmEQh8yh0PQFB3qC4JYRDWX85f16UjsMqAYO3Je9xhNMi3V14MnXGlT8k4o0:vKjfhWlT

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  ce6372568979579c7c2873764640f0c89ec148ac0a84df8c7c1125b0c048273f
- Size
  
  42KB
- MD5
  
  86c1355192609a9ec1333b27a5b5a186
- SHA1
  
  83233600c09fad1aeb3a9a0faa5e0a8d5ca0ee24
- SHA256
  
  ce6372568979579c7c2873764640f0c89ec148ac0a84df8c7c1125b0c048273f
- SHA512
  
  04547599f7561c35a83abb69e348bb8c7623a1189b32dc7b664eebc5a4a7186b2252de1a409ec5557290d444994f7b9c1840742f6813f0cab058443ddde4a9e3
- SSDEEP
  
  768:MmEQh8yh0PQFB3qC4JYRDWX85f16UjsMqAYO3Je9xhNMi3V14MnXGlT8k4o0:vKjfhWlT
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence