350bcbd13848e76b30da41278a0b0f3c2ca6d9c3b4e5b5cdb64ee24c8c8f9470 | Triage

Sharing

General

Target

aac22c5c90004cfeecd76e274e029ef3
Size

972KB
Sample

240228-cvqh4sha6z
MD5

aac22c5c90004cfeecd76e274e029ef3
SHA1

eea98faea4d810e940c7d9f62fb8035a0d48b3f6
SHA256

350bcbd13848e76b30da41278a0b0f3c2ca6d9c3b4e5b5cdb64ee24c8c8f9470
SHA512

04cde8b071172a3f8ac5bc3f74dbcff89c2ec3c1b1884e3f6a569d82b0efcf322bbf883cfb056c29b1769688e916c731770acc355fdd5d4c8f59348779005ce3
SSDEEP

12288:45DJZ9aHYol3wwuMx4tbV6LjKm96TVQxbyv99MT5t:45lalbuMWULjKgfyvM

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  aac22c5c90004cfeecd76e274e029ef3
- Size
  
  972KB
- MD5
  
  aac22c5c90004cfeecd76e274e029ef3
- SHA1
  
  eea98faea4d810e940c7d9f62fb8035a0d48b3f6
- SHA256
  
  350bcbd13848e76b30da41278a0b0f3c2ca6d9c3b4e5b5cdb64ee24c8c8f9470
- SHA512
  
  04cde8b071172a3f8ac5bc3f74dbcff89c2ec3c1b1884e3f6a569d82b0efcf322bbf883cfb056c29b1769688e916c731770acc355fdd5d4c8f59348779005ce3
- SSDEEP
  
  12288:45DJZ9aHYol3wwuMx4tbV6LjKm96TVQxbyv99MT5t:45lalbuMWULjKgfyvM
Score

8^/10

persistence
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2