b334485d7d1c10d17383dd7b3cc98e6e2d24e5beaa3ce2a68439cb72489efd6f | Triage

Sharing

General

Target

05991908597c9a7436cedc14b9bd6589
Size

11KB
Sample

231224-txmnnsaggr
MD5

05991908597c9a7436cedc14b9bd6589
SHA1

825c6e3e57b11b95bed0a60063b0052a2ba09ad9
SHA256

b334485d7d1c10d17383dd7b3cc98e6e2d24e5beaa3ce2a68439cb72489efd6f
SHA512

2a7abe20068091e177c39b17f3c0d714e3ac785b2f2dd770ed80b5587507929087a685a92a1f036e30c7d4191d0ccfce8ae995430f1720023ce196182729764e
SSDEEP

192:ruCK5CrK0nCPnm8M/IYykcyOwdyxVKj+mAIqykBqdWNxs+9ijPi:ruCor3PVMhH7OEtjj2BCWNxs+9P

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  1791446800.vbs
- Size
  
  19KB
- MD5
  
  ad448a55619de168d83350b48674eec1
- SHA1
  
  5bdc44fa234a7a9d537ec826d3b693f60619b5a4
- SHA256
  
  cea3b4531fc22f9190ffd3fd40240d557451727b9284f6bfb68206e7782c80c7
- SHA512
  
  2145fb55402fc67bb592e61e5dd68552b2c9203449c9c57670f1eaf36ffcd69ce5899f5db974708427316b61377c1949b87ed6d36d2965c08adb18c1687d098c
- SSDEEP
  
  384:4ASQR03s4s/0sFo6uETr5LzNx8Z8aeoapoMcuyipkBb4hS5vnruW2+iFJseyIR6T:lv0stNNxWTeoa1cuzgb4he12j7Ry46iK
Score

7^/10

persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Event Triggered Execution

Change Default File Association

Privilege Escalation

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2