f50e06cee4743dc8f0ad008a489c1a6a893305d795a17cecb4778c4628278ea2 | Triage

Sharing

General

Target

f50e06cee4743dc8f0ad008a489c1a6a893305d795a17cecb4778c4628278ea2
Size

224KB
Sample

221205-ml8nfaeh6s
MD5

76d77124a9a3bba0e3d28fe93b6f475a
SHA1

2013086033b63547d2ccc56f29f74133ac4fd906
SHA256

f50e06cee4743dc8f0ad008a489c1a6a893305d795a17cecb4778c4628278ea2
SHA512

f5e4f61a650e50c9d2f8326a2be34798441562baffca39435a0b4ec5e573e362d9b15573dc4e4a5cd59dfc2f37914bdaeb0dad7640ece090bae3bf98d7293db2
SSDEEP

6144:F3zFwzWQZGh9zDBXgtXV8WS0ij/LdjthuWKnvmb7/D26f7zEUg7Aw1z14l:JFwYh9nBXgtF8WhIDdjthuWKnvmb7/D5

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  f50e06cee4743dc8f0ad008a489c1a6a893305d795a17cecb4778c4628278ea2
- Size
  
  224KB
- MD5
  
  76d77124a9a3bba0e3d28fe93b6f475a
- SHA1
  
  2013086033b63547d2ccc56f29f74133ac4fd906
- SHA256
  
  f50e06cee4743dc8f0ad008a489c1a6a893305d795a17cecb4778c4628278ea2
- SHA512
  
  f5e4f61a650e50c9d2f8326a2be34798441562baffca39435a0b4ec5e573e362d9b15573dc4e4a5cd59dfc2f37914bdaeb0dad7640ece090bae3bf98d7293db2
- SSDEEP
  
  6144:F3zFwzWQZGh9zDBXgtXV8WS0ij/LdjthuWKnvmb7/D26f7zEUg7Aw1z14l:JFwYh9nBXgtF8WhIDdjthuWKnvmb7/D5
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence