c34ef7ba1e43bcfc377df576329a4606f0f80774fbbb1bc08e5827b2fcfb54f8 | Triage

Sharing

General

Target

c34ef7ba1e43bcfc377df576329a4606f0f80774fbbb1bc08e5827b2fcfb54f8
Size

80KB
Sample

221203-xvszfsgc84
MD5

1992167476bb2604f8c5a406d7fca190
SHA1

ad751c3e3d09425e9bd30520c4ec7d3935a87b29
SHA256

c34ef7ba1e43bcfc377df576329a4606f0f80774fbbb1bc08e5827b2fcfb54f8
SHA512

0cc8c32c909c06c0eaab0c7e7d2b3643f1e642f11809ba87578faeee957a8878ae19c1461e15fa611ce63db9cae456a5f78dae268a2eeb7cdf0be04929a7b019
SSDEEP

1536:pBdjB7b7LWgYCOqubrzocTzFJ0T72VpGT:L7LYVqgBTzFJ0T72aT

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c34ef7ba1e43bcfc377df576329a4606f0f80774fbbb1bc08e5827b2fcfb54f8
- Size
  
  80KB
- MD5
  
  1992167476bb2604f8c5a406d7fca190
- SHA1
  
  ad751c3e3d09425e9bd30520c4ec7d3935a87b29
- SHA256
  
  c34ef7ba1e43bcfc377df576329a4606f0f80774fbbb1bc08e5827b2fcfb54f8
- SHA512
  
  0cc8c32c909c06c0eaab0c7e7d2b3643f1e642f11809ba87578faeee957a8878ae19c1461e15fa611ce63db9cae456a5f78dae268a2eeb7cdf0be04929a7b019
- SSDEEP
  
  1536:pBdjB7b7LWgYCOqubrzocTzFJ0T72VpGT:L7LYVqgBTzFJ0T72aT
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence