e12c83225b35379c4b16dd1c924dd9aa9326e8672fd526b9ce798d7d3705db31 | Triage

Sharing

General

Target

e12c83225b35379c4b16dd1c924dd9aa9326e8672fd526b9ce798d7d3705db31
Size

770KB
Sample

231012-e1bcgsee81
MD5

094dedbf4991ec528f328a293c4f9eb7
SHA1

39093f00e825b1211d2bfdc727a4d24191f9012f
SHA256

e12c83225b35379c4b16dd1c924dd9aa9326e8672fd526b9ce798d7d3705db31
SHA512

f43b8d024b522e3f197ad7ae012485e247e51d235b5b76944dc676ebab78f98553ec5d405b4284e3d1ac9244b565b8302b0e832b446c08f9205a4c7475bde652
SSDEEP

24576:O7eit0t9EsyC1XS64DbvYwdzv1n4WwwS6u3sK:O7eimfEsr1X/4wwbn4Wpi

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  e12c83225b35379c4b16dd1c924dd9aa9326e8672fd526b9ce798d7d3705db31
- Size
  
  770KB
- MD5
  
  094dedbf4991ec528f328a293c4f9eb7
- SHA1
  
  39093f00e825b1211d2bfdc727a4d24191f9012f
- SHA256
  
  e12c83225b35379c4b16dd1c924dd9aa9326e8672fd526b9ce798d7d3705db31
- SHA512
  
  f43b8d024b522e3f197ad7ae012485e247e51d235b5b76944dc676ebab78f98553ec5d405b4284e3d1ac9244b565b8302b0e832b446c08f9205a4c7475bde652
- SSDEEP
  
  24576:O7eit0t9EsyC1XS64DbvYwdzv1n4WwwS6u3sK:O7eimfEsr1X/4wwbn4Wpi
Score

8^/10

evasion persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2