f1fce11e14fa7c5d81ec64489abe892249163adc9f5b22c31b8cbfc6610e77ef | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f1fce11e14fa7c5d81ec64489abe892249163adc9f5b22c31b8cbfc6610e77ef
Size

80KB
Sample

221206-ahhavsde8v
MD5

c49711a719d4da9788edea85c2d2fa73
SHA1

3111404535b027b0cd7c64ebd92ff034c7a94662
SHA256

f1fce11e14fa7c5d81ec64489abe892249163adc9f5b22c31b8cbfc6610e77ef
SHA512

c80dd01573e07555418e41dda702b32bd35694eca0f27948f7dcfcd1393db44fab3f8017c2bd4fad4e56f27e38e206bacffbb7c2399a34f7980e231af93afb3b
SSDEEP

1536:YkDro9Ash6VQZtlRtQlQ7pYw/zQymCJVVBZu3BHp231vcaLCCfVVG6sxai:rDvsEU8lGpD/NZBZF1vcaLCsT/MP

Score

8^/10

Malware Config

Targets

- Target
  
  PHOTO-DEVOCHKA.exe
- Size
  
  180KB
- MD5
  
  731790f96390935dcf6c9451c7b80c68
- SHA1
  
  92e152be11147d807725aa55aea4825675f654f5
- SHA256
  
  58a80f311c14624bf50f9e45db0e62a5a4902ecffeeda120ad0d775ac109d4a9
- SHA512
  
  76de1b2e02c166d79b1a5079219cc7546a61d1e982a3b58e927695001725c9f50216c2cf4bd3d49d009debd2107f68eaf9751c4bdb0408cf3a508658c58af515
- SSDEEP
  
  3072:oBAp5XhKpN4eOyVTGfhEClj8jTk+0hN7+mYnhIAhyYyOK01:fbXE9OiTGfhEClq9s+mYnhIAhy8/1
Score

8^/10
- Blocklisted process makes network request
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2