9684974e627473f3b2066bcf2598b9933d5ad53d0c635e270493b4aadc2bcb20 | Triage

Sharing

General

Target

9684974e627473f3b2066bcf2598b9933d5ad53d0c635e270493b4aadc2bcb20
Size

208KB
Sample

221203-ykqa9aec6s
MD5

0ff14b7d789d67a7648014f8ef51841b
SHA1

c72ceb4693cff9b08662c94182e48e4b5fd8d4e1
SHA256

9684974e627473f3b2066bcf2598b9933d5ad53d0c635e270493b4aadc2bcb20
SHA512

7b907501f045436ed54e8bae9021d36dd82debc90f43a285b4bede8f546d354a32ced46339a0fc48910785026ce08d2de5e3c4d568170a50f219f7c40df57ea9
SSDEEP

6144:ZRSyInsnu5W98TFK/fObT/bGiA14DFsqmVrWpMY9F4G:ZQfnL5W98TFK/fObT/bGidIrW39F4G

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  9684974e627473f3b2066bcf2598b9933d5ad53d0c635e270493b4aadc2bcb20
- Size
  
  208KB
- MD5
  
  0ff14b7d789d67a7648014f8ef51841b
- SHA1
  
  c72ceb4693cff9b08662c94182e48e4b5fd8d4e1
- SHA256
  
  9684974e627473f3b2066bcf2598b9933d5ad53d0c635e270493b4aadc2bcb20
- SHA512
  
  7b907501f045436ed54e8bae9021d36dd82debc90f43a285b4bede8f546d354a32ced46339a0fc48910785026ce08d2de5e3c4d568170a50f219f7c40df57ea9
- SSDEEP
  
  6144:ZRSyInsnu5W98TFK/fObT/bGiA14DFsqmVrWpMY9F4G:ZQfnL5W98TFK/fObT/bGidIrW39F4G
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence