1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55 | Triage

Sharing

General

Target

GJKF64.exe
Size

37KB
Sample

240104-3jlc5aefd6
MD5

c9888d06d21e682ae62498e24880d139
SHA1

1dd9679e1792468116e7da109fdf3a89a4fa1bb2
SHA256

1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55
SHA512

205e2ed37e809bf7e7db818b5f55d99bfcaba55d3875301e5fb77285fb1e1c977b11ddd34358773145add1f405330f3b426b0c8bd0ab64600007e866c0ebc9ce
SSDEEP

768:MetU1hGx8VAXQul37B5t8Rsr55U9EuB6SLFo5:M+uM5iCc9Po4O5

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  GJKF64.exe
- Size
  
  37KB
- MD5
  
  c9888d06d21e682ae62498e24880d139
- SHA1
  
  1dd9679e1792468116e7da109fdf3a89a4fa1bb2
- SHA256
  
  1181cfd2b34e7be8a43ea7335ae541ee72c2fb50ab86c1ca0155864965766a55
- SHA512
  
  205e2ed37e809bf7e7db818b5f55d99bfcaba55d3875301e5fb77285fb1e1c977b11ddd34358773145add1f405330f3b426b0c8bd0ab64600007e866c0ebc9ce
- SSDEEP
  
  768:MetU1hGx8VAXQul37B5t8Rsr55U9EuB6SLFo5:M+uM5iCc9Po4O5
Score

8^/10

evasion persistence
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence