822c70c38425452141fd3a14b605105be1612ff277b52184076acc3e117ee8a8 | Triage

Sharing

General

Target

822c70c38425452141fd3a14b605105be1612ff277b52184076acc3e117ee8a8
Size

140KB
Sample

221205-22ms8shh7y
MD5

8b4ec8b641a0b30a7d4d75c7f7011cea
SHA1

f7ace5b2d893db2629e7c6d589c1e3d681741c17
SHA256

822c70c38425452141fd3a14b605105be1612ff277b52184076acc3e117ee8a8
SHA512

a1b94f9ca218b848d7f776749e7374a03f0ef4d814f597fe92a4fd6befc9d98d41382173c828112864dec68da800158386618f1065dc45022428a4def829a31a
SSDEEP

1536:0u0VT4pNyLV4Ji2+6wl4fAsyCsJ2AyJOSfNifNuzyWREQEFrsUhKeT4oQi9t:piCi2+6CXfCZAyJH1i1uzEQE5j4oQwt

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  822c70c38425452141fd3a14b605105be1612ff277b52184076acc3e117ee8a8
- Size
  
  140KB
- MD5
  
  8b4ec8b641a0b30a7d4d75c7f7011cea
- SHA1
  
  f7ace5b2d893db2629e7c6d589c1e3d681741c17
- SHA256
  
  822c70c38425452141fd3a14b605105be1612ff277b52184076acc3e117ee8a8
- SHA512
  
  a1b94f9ca218b848d7f776749e7374a03f0ef4d814f597fe92a4fd6befc9d98d41382173c828112864dec68da800158386618f1065dc45022428a4def829a31a
- SSDEEP
  
  1536:0u0VT4pNyLV4Ji2+6wl4fAsyCsJ2AyJOSfNifNuzyWREQEFrsUhKeT4oQi9t:piCi2+6CXfCZAyJH1i1uzEQE5j4oQwt
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence