a30153637e0ae407377f15dc4f2c809cbfb0b6f866d2a490db2281df24406cde | Triage

Sharing

General

Target

a30153637e0ae407377f15dc4f2c809cbfb0b6f866d2a490db2281df24406cde
Size

52KB
Sample

221206-nm5tlsge2w
MD5

f3bb66276e7ac3a94edc1a9a9ca53c37
SHA1

e2f6fec017026e5563398fb8495ce646868e302b
SHA256

a30153637e0ae407377f15dc4f2c809cbfb0b6f866d2a490db2281df24406cde
SHA512

9cd768523c75074fa4b4b4f99d1548c160a7f5fb87d20b28043e5bb4cca9ab4496aa0ed643b6f12c6f75b59565df4bda8fd9c7fd5e28a7d9327384447f5b58d8
SSDEEP

768:GSnjtx4xj1NVf84XWWJtvdvpofMB9pXJXHMXxTIeRtYU7:1ExRrft3CaBsBTIefR7

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  a30153637e0ae407377f15dc4f2c809cbfb0b6f866d2a490db2281df24406cde
- Size
  
  52KB
- MD5
  
  f3bb66276e7ac3a94edc1a9a9ca53c37
- SHA1
  
  e2f6fec017026e5563398fb8495ce646868e302b
- SHA256
  
  a30153637e0ae407377f15dc4f2c809cbfb0b6f866d2a490db2281df24406cde
- SHA512
  
  9cd768523c75074fa4b4b4f99d1548c160a7f5fb87d20b28043e5bb4cca9ab4496aa0ed643b6f12c6f75b59565df4bda8fd9c7fd5e28a7d9327384447f5b58d8
- SSDEEP
  
  768:GSnjtx4xj1NVf84XWWJtvdvpofMB9pXJXHMXxTIeRtYU7:1ExRrft3CaBsBTIefR7
Score

8^/10

persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2