Overview

overview

8

Static

static

1

! Tritri -...re.zip

windows10-1703-x64

1

! Tritri -...re.zip

windows7-x64

1

! Tritri -...re.zip

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    ! Tritri - Sincere.zip

  • Size

    584KB

  • Sample

    230612-25c37sea74

  • MD5

    6a7f026406aed1e9c1d96fee6afa50ee

  • SHA1

    d7c38e146cb2491fccf681965f6accf0fd1d6044

  • SHA256

    d6f41cb5282056e97fe1ebbe134a42c12d042289e930e3056ce26e91b2ee4915

  • SHA512

    b8f0c3130d1055fd3fb3c54a658bfb7de0cee9701fee6167bef63362680e6c4a1e975528d86929a7f371baaeb9ba6b7f5f084e4d297d109715037a8da7a0f145

  • SSDEEP

    3072:fafkIOmcSY8zfLIOmcKLVTyafxIOmcELHTG+fuKhzcSLCDYafVIOOcIL18z+fAKJ:fTwTeDW87q0+v5aUsfOF/238ADYTr

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      ! Tritri - Sincere.zip

    • Size

      584KB

    • MD5

      6a7f026406aed1e9c1d96fee6afa50ee

    • SHA1

      d7c38e146cb2491fccf681965f6accf0fd1d6044

    • SHA256

      d6f41cb5282056e97fe1ebbe134a42c12d042289e930e3056ce26e91b2ee4915

    • SHA512

      b8f0c3130d1055fd3fb3c54a658bfb7de0cee9701fee6167bef63362680e6c4a1e975528d86929a7f371baaeb9ba6b7f5f084e4d297d109715037a8da7a0f145

    • SSDEEP

      3072:fafkIOmcSY8zfLIOmcKLVTyafxIOmcELHTG+fuKhzcSLCDYafVIOOcIL18z+fAKJ:fTwTeDW87q0+v5aUsfOF/238ADYTr

    Score
    8/10
    discoverypersistence

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v6

Tasks