8f2b449f573a92140a2c47097b7a3d74b75f7101daf36c538ed2ae2e766451ca | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8f2b449f573a92140a2c47097b7a3d74b75f7101daf36c538ed2ae2e766451ca
Size

133KB
Sample

221205-pzphtsbc36
MD5

fbf5cb4b73ce813eb85a6ab501a84f6c
SHA1

1a9983754716d96e827377ccac96f5ec7e16f42f
SHA256

8f2b449f573a92140a2c47097b7a3d74b75f7101daf36c538ed2ae2e766451ca
SHA512

ed825c4ddf0509a1fdaed7c2a2a23878ac95f26c3cf1a1295e782b51812bffcc054ceef084b0637bb090737e50e359c42ebd9c60cfc9958d13fc59232052eb9f
SSDEEP

1536:609kselPdFsYl5GDe3GeuKEZzwd1joWRv02rd9cqCmh6DY5atOXPQ6DYu8O/7f:60L65GaSu5oWRv0SJVPDkO/D

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  8f2b449f573a92140a2c47097b7a3d74b75f7101daf36c538ed2ae2e766451ca
- Size
  
  133KB
- MD5
  
  fbf5cb4b73ce813eb85a6ab501a84f6c
- SHA1
  
  1a9983754716d96e827377ccac96f5ec7e16f42f
- SHA256
  
  8f2b449f573a92140a2c47097b7a3d74b75f7101daf36c538ed2ae2e766451ca
- SHA512
  
  ed825c4ddf0509a1fdaed7c2a2a23878ac95f26c3cf1a1295e782b51812bffcc054ceef084b0637bb090737e50e359c42ebd9c60cfc9958d13fc59232052eb9f
- SSDEEP
  
  1536:609kselPdFsYl5GDe3GeuKEZzwd1joWRv02rd9cqCmh6DY5atOXPQ6DYu8O/7f:60L65GaSu5oWRv0SJVPDkO/D
Score

8^/10

evasion persistence
- Executes dropped EXE
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence