a2754f7b470f3e56a2320f4eda88133c10ac96ee45e21bceb77b284f8d5e600b | Triage

Sharing

General

Target

a2754f7b470f3e56a2320f4eda88133c10ac96ee45e21bceb77b284f8d5e600b
Size

771KB
Sample

240118-psaq4abegm
MD5

a4b777d5ba1ba699e6e8b3c5c8f48ddc
SHA1

08747541ed4dee0c334991cfda2adf7c14110406
SHA256

a2754f7b470f3e56a2320f4eda88133c10ac96ee45e21bceb77b284f8d5e600b
SHA512

7ce0e44090c0230b96f12256b6ea0bc7e8d9d60648dd95b1a8f7efea092a5892ffa3ec570c1dcd7c0f6c42733dc935a7fd812094a7daaf327ed12a75b6f2591d
SSDEEP

12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  a2754f7b470f3e56a2320f4eda88133c10ac96ee45e21bceb77b284f8d5e600b
- Size
  
  771KB
- MD5
  
  a4b777d5ba1ba699e6e8b3c5c8f48ddc
- SHA1
  
  08747541ed4dee0c334991cfda2adf7c14110406
- SHA256
  
  a2754f7b470f3e56a2320f4eda88133c10ac96ee45e21bceb77b284f8d5e600b
- SHA512
  
  7ce0e44090c0230b96f12256b6ea0bc7e8d9d60648dd95b1a8f7efea092a5892ffa3ec570c1dcd7c0f6c42733dc935a7fd812094a7daaf327ed12a75b6f2591d
- SSDEEP
  
  12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE
Score

8^/10

persistence evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistence