5a8072f4488147bda3c87c9c2edff02de9761a0551d6aa63f4e898b9d3670fe7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5a8072f4488147bda3c87c9c2edff02de9761a0551d6aa63f4e898b9d3670fe7
Size

224KB
Sample

221206-sa6mlagf45
MD5

c4110fad0df9364cd040f46dac9a80f7
SHA1

e64d74347e5d46a935d85c41854e65ef2f499bde
SHA256

5a8072f4488147bda3c87c9c2edff02de9761a0551d6aa63f4e898b9d3670fe7
SHA512

9885a1749f6c7de4d4306c29525c2f95b66f4022664b0a857b2a765efac54c36a198654c2081443ead74fda1a92b489fd9463be5cb5e6e5876a42ce5f401c595
SSDEEP

3072:ph4tkkJG7QZk5Q+RQKRQwRQqBlmZYu9EQOjI8b4brm+8RN9my4Y3qf3w1alepaWJ:12K2w2kmZ7qHbNwy/Ig1WepBvp

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  5a8072f4488147bda3c87c9c2edff02de9761a0551d6aa63f4e898b9d3670fe7
- Size
  
  224KB
- MD5
  
  c4110fad0df9364cd040f46dac9a80f7
- SHA1
  
  e64d74347e5d46a935d85c41854e65ef2f499bde
- SHA256
  
  5a8072f4488147bda3c87c9c2edff02de9761a0551d6aa63f4e898b9d3670fe7
- SHA512
  
  9885a1749f6c7de4d4306c29525c2f95b66f4022664b0a857b2a765efac54c36a198654c2081443ead74fda1a92b489fd9463be5cb5e6e5876a42ce5f401c595
- SSDEEP
  
  3072:ph4tkkJG7QZk5Q+RQKRQwRQqBlmZYu9EQOjI8b4brm+8RN9my4Y3qf3w1alepaWJ:12K2w2kmZ7qHbNwy/Ig1WepBvp
Score

8^/10

persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Checks for any installed AV software in registry
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Security Software Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2