b141946d09e1f94e727fd5a74a48e25637be3d3eb34f7e8f210d668b811969f8 | Triage

Sharing

General

Target

b141946d09e1f94e727fd5a74a48e25637be3d3eb34f7e8f210d668b811969f8
Size

53KB
Sample

240512-cxd8vsfb88
MD5

713d26727f5b28b78b189f45667c78bd
SHA1

92214eb7a28a865e4991264d2f14ff28ac456e87
SHA256

b141946d09e1f94e727fd5a74a48e25637be3d3eb34f7e8f210d668b811969f8
SHA512

71dd4165752360591793a125ec1daae74ff4d657a00b00dfa628ac8565ec3b6f0eab9f8481b8ee35b2af5101db656d3b8066ed35ccae72f9c69ac6375878d33d
SSDEEP

1536:vN5g8r8QP4mg7Kp3StjEMjmLM3ztDJWZsXy4JzxPM0:T4mgJJjmLM3zRJWZsXy4J9

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  b141946d09e1f94e727fd5a74a48e25637be3d3eb34f7e8f210d668b811969f8
- Size
  
  53KB
- MD5
  
  713d26727f5b28b78b189f45667c78bd
- SHA1
  
  92214eb7a28a865e4991264d2f14ff28ac456e87
- SHA256
  
  b141946d09e1f94e727fd5a74a48e25637be3d3eb34f7e8f210d668b811969f8
- SHA512
  
  71dd4165752360591793a125ec1daae74ff4d657a00b00dfa628ac8565ec3b6f0eab9f8481b8ee35b2af5101db656d3b8066ed35ccae72f9c69ac6375878d33d
- SSDEEP
  
  1536:vN5g8r8QP4mg7Kp3StjEMjmLM3ztDJWZsXy4JzxPM0:T4mgJJjmLM3zRJWZsXy4J9
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence