bc64bd5b8f5795d6ca0fadb314f384a717bd9c527d701d3f50ea6cb44f7eb894 | Triage

Sharing

General

Target

cf2710ca711e03c51b52c1f5f20b5f9c
Size

204KB
Sample

240409-y76xhsdd4w
MD5

cf2710ca711e03c51b52c1f5f20b5f9c
SHA1

6667784ce7d182d01fdc5c7e2ee003301155ff41
SHA256

bc64bd5b8f5795d6ca0fadb314f384a717bd9c527d701d3f50ea6cb44f7eb894
SHA512

3f6764fb7417bed9b132604d5718bfe01ef6c9fb4412a3eeb5da31acbb1fd3ba2b2602d0adaae757332e516eb3afe6f4e853da83dc7ba67f1a8b5743046fafa3
SSDEEP

3072:Iu814D52DTWor5J80AisM/8jp6tdlWbRVslWQifgO4F07lD:ItTWqJlRsM/8E/IbRuLifI07

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  cf2710ca711e03c51b52c1f5f20b5f9c
- Size
  
  204KB
- MD5
  
  cf2710ca711e03c51b52c1f5f20b5f9c
- SHA1
  
  6667784ce7d182d01fdc5c7e2ee003301155ff41
- SHA256
  
  bc64bd5b8f5795d6ca0fadb314f384a717bd9c527d701d3f50ea6cb44f7eb894
- SHA512
  
  3f6764fb7417bed9b132604d5718bfe01ef6c9fb4412a3eeb5da31acbb1fd3ba2b2602d0adaae757332e516eb3afe6f4e853da83dc7ba67f1a8b5743046fafa3
- SSDEEP
  
  3072:Iu814D52DTWor5J80AisM/8jp6tdlWbRVslWQifgO4F07lD:ItTWqJlRsM/8E/IbRuLifI07
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence