cb9b8ec4097b32c9cd2d23027b2bf23be47f987e7247a154435e8d7c795b1778 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Quotation_PDF.xz
Size

750KB
Sample

230324-q7xd3sgg9z
MD5

0d9b1b290fd88cb9ef5615fa363efe82
SHA1

60a46784989cccf9c791d8c0dd7221e71d460624
SHA256

cb9b8ec4097b32c9cd2d23027b2bf23be47f987e7247a154435e8d7c795b1778
SHA512

534e11f1c215f3853fed26a0a56b2523848b340684d563fe47be55f86f1bd809acfcfd38663909198c4fde9608671860a41eb6de2094b97f9945bbfb1c63c503
SSDEEP

12288:+YnwK02ocpRHVQfjWn1Ysec7E0tJ9hSnUV1sod3DxyvPthvstmUs6LQ2saqqWk:+Ynt0SpRHCsVTWUV1sC3VKPzv0s6LQ27

Score

7^/10

Malware Config

Targets

- Target
  
  Quotation_PDF.exe
- Size
  
  822KB
- MD5
  
  0bd3bed010219c2e46415ecc343cefa1
- SHA1
  
  1e9af952b17e0f194debdd53aba1266b6eed4fd7
- SHA256
  
  064913ff8fa1ee140fc8b6390a24c81f24774d8318ddcea986d41c941ca4cc61
- SHA512
  
  283ffbc5fb679348b95c2883e8b06829e203b0d7fe01c46ce01870fed4222e58bebd4115d3d416f7d023601aa2bd6cd995a2240ba323fc9a8e4278d3ee91f9ec
- SSDEEP
  
  12288:Kvv2SUvKN/Pyr3vOVmS5Cv9OGMMxjA7xjWfuZC3Wngo0PvV8Oz+Jcb7OV9l:o+vr3BpOGrxjcCe0tscmHl
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2