8e4277730d59545ec3a82a0b2658d4001018494bb5d8256f3089939ebcecdb58 | Triage

Sharing

General

Target

8e4277730d59545ec3a82a0b2658d4001018494bb5d8256f3089939ebcecdb58
Size

292KB
Sample

221205-3hb33age93
MD5

68f04bbdca2471b6a17c35ed6a04562e
SHA1

bfc5582323682e8c4c30b8c8850e0b489636336f
SHA256

8e4277730d59545ec3a82a0b2658d4001018494bb5d8256f3089939ebcecdb58
SHA512

406bb6ddb3f9bd921f50c9b3d41cfeeb9619b7814f9fcbcbbf81534c05f37adb21fc37ef3d3f196de50f3d78b563c0c561d881e9c3a597d2764aef90d73f9f68
SSDEEP

6144:tmYlwQkyaUP9VO3oni7fUX5K/fObT/bGilTBpSthkZ7xCrLOzpq7wjMpxkkhHVB:tZlwQYUV03o9X5K/fObT/bGi4hkZ7xCp

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  8e4277730d59545ec3a82a0b2658d4001018494bb5d8256f3089939ebcecdb58
- Size
  
  292KB
- MD5
  
  68f04bbdca2471b6a17c35ed6a04562e
- SHA1
  
  bfc5582323682e8c4c30b8c8850e0b489636336f
- SHA256
  
  8e4277730d59545ec3a82a0b2658d4001018494bb5d8256f3089939ebcecdb58
- SHA512
  
  406bb6ddb3f9bd921f50c9b3d41cfeeb9619b7814f9fcbcbbf81534c05f37adb21fc37ef3d3f196de50f3d78b563c0c561d881e9c3a597d2764aef90d73f9f68
- SSDEEP
  
  6144:tmYlwQkyaUP9VO3oni7fUX5K/fObT/bGilTBpSthkZ7xCrLOzpq7wjMpxkkhHVB:tZlwQYUV03o9X5K/fObT/bGi4hkZ7xCp
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence