c25879e4ae98b9444d07e2db0cbed3fcca10f57bd0cfea29e7582b5dfadb8f23 | Triage

Sharing

General

Target

bf5c27d26fee681a52855db9a03724e0
Size

45KB
Sample

240311-arwjvafd44
MD5

bf5c27d26fee681a52855db9a03724e0
SHA1

16e790109e158f9395d2ab1516d99b715a4b5db0
SHA256

c25879e4ae98b9444d07e2db0cbed3fcca10f57bd0cfea29e7582b5dfadb8f23
SHA512

5c4be5362f43922318690339ce941e7e1e9e9fbcbba9ace2d8ea02338677eb4b6ef2c2ccf7cc13ac5b038417718a1f4a17b378ab6f1e60a135f9c5c973da1f80
SSDEEP

768:b9Y0E0sWUEm+W7giFrOx0/FK+gb0OSzA53FpP/CqQ7vOjoSpjKhahrB:5h/sEiFixoFK+spP/ZQ7xSpjF1B

Score

10^/10

evasion

Malware Config

Targets

- Target
  
  bf5c27d26fee681a52855db9a03724e0
- Size
  
  45KB
- MD5
  
  bf5c27d26fee681a52855db9a03724e0
- SHA1
  
  16e790109e158f9395d2ab1516d99b715a4b5db0
- SHA256
  
  c25879e4ae98b9444d07e2db0cbed3fcca10f57bd0cfea29e7582b5dfadb8f23
- SHA512
  
  5c4be5362f43922318690339ce941e7e1e9e9fbcbba9ace2d8ea02338677eb4b6ef2c2ccf7cc13ac5b038417718a1f4a17b378ab6f1e60a135f9c5c973da1f80
- SSDEEP
  
  768:b9Y0E0sWUEm+W7giFrOx0/FK+gb0OSzA53FpP/CqQ7vOjoSpjKhahrB:5h/sEiFixoFK+spP/ZQ7xSpjF1B
Score

10^/10

evasion
- Modifies firewall policy service
  evasion
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2