c7fe6ecb86c0679d3e6bc54f26358a692e0c16de6e737a4082f3d4fec426392b | Triage

Sharing

General

Target

c7fe6ecb86c0679d3e6bc54f26358a692e0c16de6e737a4082f3d4fec426392b
Size

92KB
Sample

240502-d379kahg82
MD5

73e83cc5ee6460a28d3fa52a58355c6e
SHA1

e6f0d849188dabcfadfbe8cbde989f788fbb7253
SHA256

c7fe6ecb86c0679d3e6bc54f26358a692e0c16de6e737a4082f3d4fec426392b
SHA512

0209897cbc02056d88657d331c374e465487a35170cc5c3f4ee265fb1a29cc50e147601d10bb6f894d0c4e05a6f099138ed537ba0b7e865337e4ecac277c84e3
SSDEEP

1536:p7u6cOLK7hNIMLrCiS4xUfXM3xvuoSB5qEftLhSnWQD+hpX71qCi2:1eOLK7hNIMLrCiS4+PwRjY5xhEAXQCD

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  c7fe6ecb86c0679d3e6bc54f26358a692e0c16de6e737a4082f3d4fec426392b
- Size
  
  92KB
- MD5
  
  73e83cc5ee6460a28d3fa52a58355c6e
- SHA1
  
  e6f0d849188dabcfadfbe8cbde989f788fbb7253
- SHA256
  
  c7fe6ecb86c0679d3e6bc54f26358a692e0c16de6e737a4082f3d4fec426392b
- SHA512
  
  0209897cbc02056d88657d331c374e465487a35170cc5c3f4ee265fb1a29cc50e147601d10bb6f894d0c4e05a6f099138ed537ba0b7e865337e4ecac277c84e3
- SSDEEP
  
  1536:p7u6cOLK7hNIMLrCiS4xUfXM3xvuoSB5qEftLhSnWQD+hpX71qCi2:1eOLK7hNIMLrCiS4+PwRjY5xhEAXQCD
Score

8^/10

persistence
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2