49489ebcf00f954b9a3dcb4a1b0272a2d465c642df4b2d235c0e9daa01823beb | Triage

Sharing

General

Target

49489ebcf00f954b9a3dcb4a1b0272a2d465c642df4b2d235c0e9daa01823beb
Size

771KB
Sample

240103-hphh7scbfq
MD5

d432cc6717128fec8218416961241463
SHA1

abab03274683a49e1879fb9497c190502ceceb31
SHA256

49489ebcf00f954b9a3dcb4a1b0272a2d465c642df4b2d235c0e9daa01823beb
SHA512

cc40e7e85e02796b4ae2618037e6a652af6863ab677693fd10b697554da2803a98b1c08453147fe7dd3dc1e256f191304f05e0f8d62c2908181dcd9be192e3d9
SSDEEP

12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  49489ebcf00f954b9a3dcb4a1b0272a2d465c642df4b2d235c0e9daa01823beb
- Size
  
  771KB
- MD5
  
  d432cc6717128fec8218416961241463
- SHA1
  
  abab03274683a49e1879fb9497c190502ceceb31
- SHA256
  
  49489ebcf00f954b9a3dcb4a1b0272a2d465c642df4b2d235c0e9daa01823beb
- SHA512
  
  cc40e7e85e02796b4ae2618037e6a652af6863ab677693fd10b697554da2803a98b1c08453147fe7dd3dc1e256f191304f05e0f8d62c2908181dcd9be192e3d9
- SSDEEP
  
  12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE
Score

8^/10

evasion persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2