42fbd98c949e98a02eabefbc6b3660c3f37266ab41eabbb86e95c6e992184a5a | Triage

Sharing

General

Target

0c06f083669936e75cb5782736ad8b7a
Size

78KB
Sample

231224-w57pxsadb2
MD5

0c06f083669936e75cb5782736ad8b7a
SHA1

02b6ad6159b912a4c18e7547f7124a8f17112526
SHA256

42fbd98c949e98a02eabefbc6b3660c3f37266ab41eabbb86e95c6e992184a5a
SHA512

24089c56140497abdf96ecb434812e0e966a635eaa056326d8f03db22a2376a644d919173d7ae59471ffa3e757784b7ba61ae49f34d7a268c8299831587c594e
SSDEEP

1536:B3x5wUDc03v7M4qZmMwo23LSXxIhRsYHHsiLLqGeg:xx5wUDc4TNqs5o23LnPsYHMiLLk

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  0c06f083669936e75cb5782736ad8b7a
- Size
  
  78KB
- MD5
  
  0c06f083669936e75cb5782736ad8b7a
- SHA1
  
  02b6ad6159b912a4c18e7547f7124a8f17112526
- SHA256
  
  42fbd98c949e98a02eabefbc6b3660c3f37266ab41eabbb86e95c6e992184a5a
- SHA512
  
  24089c56140497abdf96ecb434812e0e966a635eaa056326d8f03db22a2376a644d919173d7ae59471ffa3e757784b7ba61ae49f34d7a268c8299831587c594e
- SSDEEP
  
  1536:B3x5wUDc03v7M4qZmMwo23LSXxIhRsYHHsiLLqGeg:xx5wUDc4TNqs5o23LnPsYHMiLLk
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence