f20e9e43c7524dbdb1ac10449a3ac79ea691b7da91868b8fec0c79b4778e2b82 | Triage

Sharing

General

Target

f20e9e43c7524dbdb1ac10449a3ac79ea691b7da91868b8fec0c79b4778e2b82
Size

771KB
Sample

231023-tzbn7acb58
MD5

b95418d855a86235c4207925e5c3ed85
SHA1

8b474af23c3116db260d88349c6528b5f3a394b6
SHA256

f20e9e43c7524dbdb1ac10449a3ac79ea691b7da91868b8fec0c79b4778e2b82
SHA512

d4601b9a93aa8c86dedfa0f44f37a97198fe15a6989a5bcbeccf02cb83dcab1e22195ba8249f06315c317f67518c76b3616d15918f7a44a71fa95b5f68b5c3bd
SSDEEP

12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  f20e9e43c7524dbdb1ac10449a3ac79ea691b7da91868b8fec0c79b4778e2b82
- Size
  
  771KB
- MD5
  
  b95418d855a86235c4207925e5c3ed85
- SHA1
  
  8b474af23c3116db260d88349c6528b5f3a394b6
- SHA256
  
  f20e9e43c7524dbdb1ac10449a3ac79ea691b7da91868b8fec0c79b4778e2b82
- SHA512
  
  d4601b9a93aa8c86dedfa0f44f37a97198fe15a6989a5bcbeccf02cb83dcab1e22195ba8249f06315c317f67518c76b3616d15918f7a44a71fa95b5f68b5c3bd
- SSDEEP
  
  12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE
Score

8^/10

evasion persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2