3e1b03be93eb391059228f022c264c4d73a2f2515926f1ea73c12dd0a6395e17 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e1b03be93eb391059228f022c264c4d73a2f2515926f1ea73c12dd0a6395e17
Size

771KB
Sample

231211-l2ws5sdab9
MD5

e285ccd26777c749b56c3fe487f5136c
SHA1

3e511b82f41202ce2cd61ab877fe5928ca8a4f03
SHA256

3e1b03be93eb391059228f022c264c4d73a2f2515926f1ea73c12dd0a6395e17
SHA512

dedb3debe05114a001307b9db65328f6a250e921c71b3b5e9f05ee51b760b0d0f69ac8ccf20db5539c852a59a3e7715ef649a3326fbb5fbf3496dcfb42ed7dc2
SSDEEP

12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  3e1b03be93eb391059228f022c264c4d73a2f2515926f1ea73c12dd0a6395e17
- Size
  
  771KB
- MD5
  
  e285ccd26777c749b56c3fe487f5136c
- SHA1
  
  3e511b82f41202ce2cd61ab877fe5928ca8a4f03
- SHA256
  
  3e1b03be93eb391059228f022c264c4d73a2f2515926f1ea73c12dd0a6395e17
- SHA512
  
  dedb3debe05114a001307b9db65328f6a250e921c71b3b5e9f05ee51b760b0d0f69ac8ccf20db5539c852a59a3e7715ef649a3326fbb5fbf3496dcfb42ed7dc2
- SSDEEP
  
  12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE
Score

8^/10

persistence evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistence