6380c6a0cfeaa8c91b5c4de75539255c14fe313934ec973179d3b4d6aac79c11 | Triage

Sharing

General

Target

de9dd0c28688277931a9dfe95f09c5c0
Size

302KB
Sample

240325-wk2ceahe6w
MD5

de9dd0c28688277931a9dfe95f09c5c0
SHA1

a2e2cfac5bc021a692f71857aa31250869c2e6c6
SHA256

6380c6a0cfeaa8c91b5c4de75539255c14fe313934ec973179d3b4d6aac79c11
SHA512

3dd1e198cf4b59aff2e66537faf29d8c7c02d636d8bc58e01984c548655c352502a9d9a456e62536eede1d047e286d7f2ff73a18db4f5c0132d47d1fcf43fa85
SSDEEP

6144:wfgpnTfV/4RJXkcNT43KS3KD5pJi7NVEMbOM0lcHUfh5C6KgN5E57:ZlJkh43Y5i0nlcHUJMx

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  de9dd0c28688277931a9dfe95f09c5c0
- Size
  
  302KB
- MD5
  
  de9dd0c28688277931a9dfe95f09c5c0
- SHA1
  
  a2e2cfac5bc021a692f71857aa31250869c2e6c6
- SHA256
  
  6380c6a0cfeaa8c91b5c4de75539255c14fe313934ec973179d3b4d6aac79c11
- SHA512
  
  3dd1e198cf4b59aff2e66537faf29d8c7c02d636d8bc58e01984c548655c352502a9d9a456e62536eede1d047e286d7f2ff73a18db4f5c0132d47d1fcf43fa85
- SSDEEP
  
  6144:wfgpnTfV/4RJXkcNT43KS3KD5pJi7NVEMbOM0lcHUfh5C6KgN5E57:ZlJkh43Y5i0nlcHUJMx
Score

8^/10

persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2