9ff888b086d928dcd66985e4b89aad02dcd2b97b750a392cdbac2a79453df59c | Triage

Sharing

General

Target

9ff888b086d928dcd66985e4b89aad02dcd2b97b750a392cdbac2a79453df59c
Size

149KB
Sample

240523-bhkawsfh4z
MD5

d3965ed87e85d69cf6a16aff968a597d
SHA1

773e80623299d0ce1c0b337b69c02a1ec034cf61
SHA256

9ff888b086d928dcd66985e4b89aad02dcd2b97b750a392cdbac2a79453df59c
SHA512

7f4075540676284bd8f1ba20d530ffb198a3491fa32ade1dc9b52e7c6397d3b36f810a0fcc11a8b3ca32b504dab41a06fa4061685ca0970ef425a6f39162c734
SSDEEP

1536:IaQJ4uxhhlPbJHS9sf2bsqzln3R4stMOiWGEP7w02rd9cqCmh6DY5atOXPQWzfba:IaQ/xrHS9sf2QQRsEP7w0SJVvbktO0h7

Score

10^/10

evasion execution persistence

Malware Config

Targets

- Target
  
  9ff888b086d928dcd66985e4b89aad02dcd2b97b750a392cdbac2a79453df59c
- Size
  
  149KB
- MD5
  
  d3965ed87e85d69cf6a16aff968a597d
- SHA1
  
  773e80623299d0ce1c0b337b69c02a1ec034cf61
- SHA256
  
  9ff888b086d928dcd66985e4b89aad02dcd2b97b750a392cdbac2a79453df59c
- SHA512
  
  7f4075540676284bd8f1ba20d530ffb198a3491fa32ade1dc9b52e7c6397d3b36f810a0fcc11a8b3ca32b504dab41a06fa4061685ca0970ef425a6f39162c734
- SSDEEP
  
  1536:IaQJ4uxhhlPbJHS9sf2bsqzln3R4stMOiWGEP7w02rd9cqCmh6DY5atOXPQWzfba:IaQ/xrHS9sf2QQRsEP7w0SJVvbktO0h7
Score

10^/10

evasion execution persistence
- Disables service(s)
  evasion execution
- Detects executables containing possible sandbox analysis VM usernames
- Blocklisted process makes network request
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

evasionexecutionpersistence

behavioral2

evasionexecutionpersistence