cb290c220f3e548dcbb6da1833165d4fc1a5cac6ab2f3636d1f25baaf4dd2079 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RFQ # 1045981 - MAA_D Plant Project r01.rar
Size

755KB
Sample

230613-l3cfwsgb8v
MD5

1ff755d7e027f42ed86782a72276b0b7
SHA1

f7fe7e24e31bb0047e20d9c3725a636587535d11
SHA256

cb290c220f3e548dcbb6da1833165d4fc1a5cac6ab2f3636d1f25baaf4dd2079
SHA512

b12fb6b6e728c6441aa96069797f1aef78fef37de70c121a9e99cf1262d50bef333f1b71dd7b73f2f3e738e6fd8e0b2e5eb0645731b7eb6d7659f14e5cf6241b
SSDEEP

12288:Ahoy/z6XJ4NVvYVIJnxRIaNRooLobKRYwCM+542RgxAnaB8Ju/c1gySsW:Ahoy/z6XGvYIZ6m3CN42RgxjB8c/S8sW

Score

7^/10

Malware Config

Targets

- Target
  
  RFQ # 1045981 - MAA_D Plant Project r01.exe
- Size
  
  875KB
- MD5
  
  ac256a867183ec9f1a370bc41b58015d
- SHA1
  
  aaf4813c5870ff0882a4453904f8533db69bea75
- SHA256
  
  13c73dff53867a75126ec548cad96b47a82f412dfc347b7b68c97fbbdb33d818
- SHA512
  
  b09f63e657ca5ed04724cfe36e83cc62952e3dbdeb929f9e4ac3e9167573fa569a561a0cd2c3575c2f77349ea793c808acbd61f941bf7e6e8dd512f0f46cb760
- SSDEEP
  
  24576:B1gG1tCueiqrBvclUBhDrznW8OAqZDag49G6D3f8+8/Wi0:vgqtCDiqrhhznHWZODI6D3U+bi0
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2