67640e0c7caccc4ef60d89c060d595bd7059e31cfdd2b34880fe38fe6beeb8d8 | Triage

Sharing

General

Target

67640e0c7caccc4ef60d89c060d595bd7059e31cfdd2b34880fe38fe6beeb8d8
Size

252KB
Sample

221203-yrn2rsba77
MD5

761f88705c41c68d11e2cb0f2f384405
SHA1

9cffac6d0250b14369e24215763df9cf8b170977
SHA256

67640e0c7caccc4ef60d89c060d595bd7059e31cfdd2b34880fe38fe6beeb8d8
SHA512

f0d6cbcf340b24b9b2bfef9e37931506a04074017a3bc7695d299eef41ef9a4c2a26dd46b9715b7c2b949973af28068aa7b7e3b3ae484dd56aedfa02e25881b2
SSDEEP

3072:lrAcex7LaLdsWvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKTq0:lrjFx/ZLA4PmG6d

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  67640e0c7caccc4ef60d89c060d595bd7059e31cfdd2b34880fe38fe6beeb8d8
- Size
  
  252KB
- MD5
  
  761f88705c41c68d11e2cb0f2f384405
- SHA1
  
  9cffac6d0250b14369e24215763df9cf8b170977
- SHA256
  
  67640e0c7caccc4ef60d89c060d595bd7059e31cfdd2b34880fe38fe6beeb8d8
- SHA512
  
  f0d6cbcf340b24b9b2bfef9e37931506a04074017a3bc7695d299eef41ef9a4c2a26dd46b9715b7c2b949973af28068aa7b7e3b3ae484dd56aedfa02e25881b2
- SSDEEP
  
  3072:lrAcex7LaLdsWvZ0OgRqTAJcLGGO/xuiEyJeOOeGs5oxnkNzQKTq0:lrjFx/ZLA4PmG6d
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence