47325afa530e83455f846b753a910b80e6fad4a505ff996d6e8809b5f1bc4357 | Triage

Sharing

General

Target

47ccff97d013267a409934221107de80N.exe
Size

179KB
Sample

240726-bqvrlaxcqp
MD5

47ccff97d013267a409934221107de80
SHA1

7dcf133b3fa675d6f0b564f26e3e5115e8ca2f2b
SHA256

47325afa530e83455f846b753a910b80e6fad4a505ff996d6e8809b5f1bc4357
SHA512

11a88b8dae1c73f55b118960bd2176802be0d191f12895cdfc50c7001d24770b6e1a56002c0b097cf378fe17a09863b2252ffdae945f3c0f508258009d23b652
SSDEEP

3072:QXTTASJKf2n5AxE2NpxOa2XdU2QF4s5XgIDFyHb8kHofL/09rGB:QvASJKenie2xT2NU2OTFQb8Fb0IB

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  47ccff97d013267a409934221107de80N.exe
- Size
  
  179KB
- MD5
  
  47ccff97d013267a409934221107de80
- SHA1
  
  7dcf133b3fa675d6f0b564f26e3e5115e8ca2f2b
- SHA256
  
  47325afa530e83455f846b753a910b80e6fad4a505ff996d6e8809b5f1bc4357
- SHA512
  
  11a88b8dae1c73f55b118960bd2176802be0d191f12895cdfc50c7001d24770b6e1a56002c0b097cf378fe17a09863b2252ffdae945f3c0f508258009d23b652
- SSDEEP
  
  3072:QXTTASJKf2n5AxE2NpxOa2XdU2QF4s5XgIDFyHb8kHofL/09rGB:QvASJKenie2xT2NU2OTFQb8Fb0IB
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence