c7762a0b4d8b5bf3654099c7d502e3a677e2e99c61c6dfee0ae4b8acd181be68 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c7762a0b4d8b5bf3654099c7d502e3a677e2e99c61c6dfee0ae4b8acd181be68
Size

156KB
Sample

221203-vzjkgadh5x
MD5

37b05a37ac32da9c8a65500309bc9085
SHA1

58c683883ed4c6133eb80cd1187c2af8f41ec4c3
SHA256

c7762a0b4d8b5bf3654099c7d502e3a677e2e99c61c6dfee0ae4b8acd181be68
SHA512

df5e5374bd0223b5d3fcae7ce984383a31c9246121f3fe0c0ef0a45afc9a883048b4ddaf4655a64b335ba9b39c208e10ad6f6fabb7c19dad3ea6e0932a37e3f8
SSDEEP

3072:r8Goe5g+GwD8w2+d5bWIrJ4E5n41sSLeH8ozK/d/18UlyG4oQZiE7dZ:Q2WIrJ4E5n41pVN/jhFW1r

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c7762a0b4d8b5bf3654099c7d502e3a677e2e99c61c6dfee0ae4b8acd181be68
- Size
  
  156KB
- MD5
  
  37b05a37ac32da9c8a65500309bc9085
- SHA1
  
  58c683883ed4c6133eb80cd1187c2af8f41ec4c3
- SHA256
  
  c7762a0b4d8b5bf3654099c7d502e3a677e2e99c61c6dfee0ae4b8acd181be68
- SHA512
  
  df5e5374bd0223b5d3fcae7ce984383a31c9246121f3fe0c0ef0a45afc9a883048b4ddaf4655a64b335ba9b39c208e10ad6f6fabb7c19dad3ea6e0932a37e3f8
- SSDEEP
  
  3072:r8Goe5g+GwD8w2+d5bWIrJ4E5n41sSLeH8ozK/d/18UlyG4oQZiE7dZ:Q2WIrJ4E5n41pVN/jhFW1r
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence