3ca83d3d6900587f9823eda0ea431e4e9012b7179d53974798e3b4821d2b348e | Triage

Sharing

General

Target

3ca83d3d6900587f9823eda0ea431e4e9012b7179d53974798e3b4821d2b348e
Size

137KB
Sample

240311-zh7m7adh2v
MD5

41f36b7364ae75a23d53115e25242e11
SHA1

dec728ce00c78eb5aada2d908453864284f2a871
SHA256

3ca83d3d6900587f9823eda0ea431e4e9012b7179d53974798e3b4821d2b348e
SHA512

ff21c60cc550f12d605693641ed298b4479997134d6eaa0946a756efec45108fab3b6c86b806457f7ccf57c6a295c4279aaa4dcc618ff691d0b767478c81f72a
SSDEEP

3072:r1i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU81:Ji/NjO5x0Xg+UGSYnuy3Oai/Nd

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  3ca83d3d6900587f9823eda0ea431e4e9012b7179d53974798e3b4821d2b348e
- Size
  
  137KB
- MD5
  
  41f36b7364ae75a23d53115e25242e11
- SHA1
  
  dec728ce00c78eb5aada2d908453864284f2a871
- SHA256
  
  3ca83d3d6900587f9823eda0ea431e4e9012b7179d53974798e3b4821d2b348e
- SHA512
  
  ff21c60cc550f12d605693641ed298b4479997134d6eaa0946a756efec45108fab3b6c86b806457f7ccf57c6a295c4279aaa4dcc618ff691d0b767478c81f72a
- SSDEEP
  
  3072:r1i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU81:Ji/NjO5x0Xg+UGSYnuy3Oai/Nd
Score

8^/10

persistence
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2