fb483070c6cb6d583107b29c6612fa742b6321c66cf9f045f7ba55e71e942856 | Triage

Sharing

General

Target

LDPlayer9_ens_com.lark.snake.fire_3040_ld.zip
Size

1.2MB
Sample

230728-p6ay1sea3t
MD5

f12174d6742a978f1dc0174528645f30
SHA1

593bfd143212e245cad66ca410a545ae80a23469
SHA256

fb483070c6cb6d583107b29c6612fa742b6321c66cf9f045f7ba55e71e942856
SHA512

19791b6205513981800753e594a15d7faffadd2ec8edc1ac5026642837d23e1aec4f2512c4536feff4384e319a4990cc8b6ffb6ad192c8a7193e873993eedb6d
SSDEEP

24576:tlAxAQJeK2dg/WQb7yGvVnKd4WSsB+MkGGP/y2Y42jJXSQYv2W:7AxB2dgeQvzV4BuhP/y2Y421XSQiX

Score

8^/10

discovery exploit persistence

Malware Config

Targets

- Target
  
  LDPlayer9_ens_com.lark.snake.fire_3040_ld.exe
- Size
  
  2.5MB
- MD5
  
  83c2a7913043419ef1e31973e69d00d1
- SHA1
  
  55c1d6abbe4c7e2b5921a9d4ab82d3b7a4ee23e3
- SHA256
  
  a2d0d1739b392a98fc66ad4fa82ab3102ddf117bf0b5771ca3a5f8d3295e2184
- SHA512
  
  cc433e4ebeabef236a4ca8ecf0c6c7c3474949a7d16b8a68de8c8e2674542e3155ed095b4dda96e2dcd22725725ea9edf8226599869225152955ef8854a3f29a
- SSDEEP
  
  24576:r43bxJag6IHA7pYkWzRpi3UZGIlXHg1qQrlRUK80U3612926/kvppVUm4ReeIPEY:g/6Ig7pwjTElRQ0UK1ukx0RbKEL8F
Score

8^/10

discovery exploit persistence
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Possible privilege escalation attempt
  exploit
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexploitpersistence