07de665cad9e7f7b945b8379e7f570e0f3c8aeb627771747d027c6cf43bc5023 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2aa45215d0840cfaf23c7aaa3a63da4c
Size

260KB
Sample

231231-gh559ahcek
MD5

2aa45215d0840cfaf23c7aaa3a63da4c
SHA1

3875a9faa09d0db65c92e134976fb33469ddcbc0
SHA256

07de665cad9e7f7b945b8379e7f570e0f3c8aeb627771747d027c6cf43bc5023
SHA512

d0e8f8e21dff180c25c969ce1c33e9aa03979a3d0173f1ff230f2f6b8d213a8132eee0234641b6a89d0bde6f2e4afbc3ee0f9b5dbf9b3fa18047c315780e2816
SSDEEP

6144:koqb5nZUodUWGS5WvBQs2jma/yViz9tm5jKFh1TKICxene:h4Z1mBQTS6gtKFhhKf

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  2aa45215d0840cfaf23c7aaa3a63da4c
- Size
  
  260KB
- MD5
  
  2aa45215d0840cfaf23c7aaa3a63da4c
- SHA1
  
  3875a9faa09d0db65c92e134976fb33469ddcbc0
- SHA256
  
  07de665cad9e7f7b945b8379e7f570e0f3c8aeb627771747d027c6cf43bc5023
- SHA512
  
  d0e8f8e21dff180c25c969ce1c33e9aa03979a3d0173f1ff230f2f6b8d213a8132eee0234641b6a89d0bde6f2e4afbc3ee0f9b5dbf9b3fa18047c315780e2816
- SSDEEP
  
  6144:koqb5nZUodUWGS5WvBQs2jma/yViz9tm5jKFh1TKICxene:h4Z1mBQTS6gtKFhhKf
Score

8^/10

evasion persistence
- Adds policy Run key to start application
  persistence
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence