c145096c905e1fa52c1d7cd6d5af081fec76be3dd0d9da63db01eb49da825d63 | Triage

Sharing

General

Target

c145096c905e1fa52c1d7cd6d5af081fec76be3dd0d9da63db01eb49da825d63
Size

770KB
Sample

231014-dz3jxadf21
MD5

3c067564fd6f8b659e8ff59ff3ec5dc6
SHA1

4838dd0d7d17e1f6ccca12330cfd34863603714f
SHA256

c145096c905e1fa52c1d7cd6d5af081fec76be3dd0d9da63db01eb49da825d63
SHA512

0e61f9d1051c489e3fd8698922447ce46aef123c9c2c099f1256336a6fbdfb7884a9a04ee4a52433cc44211f46c7f0dca340bddd379fd3489ebbe1bf85faf3f6
SSDEEP

24576:O7eit0t9EsyC1XS64DbvYwdzv1n4WwwS6u3sK:O7eimfEsr1X/4wwbn4Wpi

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  c145096c905e1fa52c1d7cd6d5af081fec76be3dd0d9da63db01eb49da825d63
- Size
  
  770KB
- MD5
  
  3c067564fd6f8b659e8ff59ff3ec5dc6
- SHA1
  
  4838dd0d7d17e1f6ccca12330cfd34863603714f
- SHA256
  
  c145096c905e1fa52c1d7cd6d5af081fec76be3dd0d9da63db01eb49da825d63
- SHA512
  
  0e61f9d1051c489e3fd8698922447ce46aef123c9c2c099f1256336a6fbdfb7884a9a04ee4a52433cc44211f46c7f0dca340bddd379fd3489ebbe1bf85faf3f6
- SSDEEP
  
  24576:O7eit0t9EsyC1XS64DbvYwdzv1n4WwwS6u3sK:O7eimfEsr1X/4wwbn4Wpi
Score

8^/10

persistence evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistence