Overview

overview

10

Static

static

cfcfd71484...a4.exe

windows7-x64

10

cfcfd71484...a4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cfcfd71484ab3ebb94cd72bc03cda49f1df44ecf7cf4184e282ad647d6e0a7a4

  • Size

    154KB

  • Sample

    221203-zbmdnsgf7x

  • MD5

    485a0ee0071428b92fa5f4778be55b24

  • SHA1

    1142eadb8bf503a8730517b56ce6478f62955f7e

  • SHA256

    cfcfd71484ab3ebb94cd72bc03cda49f1df44ecf7cf4184e282ad647d6e0a7a4

  • SHA512

    820ea5aacebe808a3ff861c84c93e1ed58b90d78a8eb654260c0390f6a0e06d729c15c365a597341b39a4cd619a80e2db5dca9ae11c8ec0f20630d0b842c4a61

  • SSDEEP

    3072:J/P/d4UYVULB+La7ijQqXWuVB3vUidQxSeBnULc5uszD9dDy6HaYFbhjChBd:J/P/d4UYVULB+La7i5VB3simxFBnULck

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      cfcfd71484ab3ebb94cd72bc03cda49f1df44ecf7cf4184e282ad647d6e0a7a4

    • Size

      154KB

    • MD5

      485a0ee0071428b92fa5f4778be55b24

    • SHA1

      1142eadb8bf503a8730517b56ce6478f62955f7e

    • SHA256

      cfcfd71484ab3ebb94cd72bc03cda49f1df44ecf7cf4184e282ad647d6e0a7a4

    • SHA512

      820ea5aacebe808a3ff861c84c93e1ed58b90d78a8eb654260c0390f6a0e06d729c15c365a597341b39a4cd619a80e2db5dca9ae11c8ec0f20630d0b842c4a61

    • SSDEEP

      3072:J/P/d4UYVULB+La7ijQqXWuVB3vUidQxSeBnULc5uszD9dDy6HaYFbhjChBd:J/P/d4UYVULB+La7i5VB3simxFBnULck

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks