8868a7cc9adfec0c694a21b87cf43db6cbd5a8cc8a923b662d19b653a524124e | Triage

Sharing

General

Target

b4be4dd9b085ff32b35e9374254ba530N.exe
Size

394KB
Sample

240727-l7bp6awejb
MD5

b4be4dd9b085ff32b35e9374254ba530
SHA1

22a4d1cdda00ab4ce9b67c04366eaef9be06d08f
SHA256

8868a7cc9adfec0c694a21b87cf43db6cbd5a8cc8a923b662d19b653a524124e
SHA512

301cc249310c06545bff12f5f0c60d0c051fde35834d9eb3c235b5f1374dfcb83e46fc74ee8ba02e22b78c281b90f61bed01107ebc39b65fa29eae19f810993c
SSDEEP

6144:38ASJKenie2xT2NU2OTFQb8Fb0I1UfFmPGL:3A5nilTFQbI0a+GGL

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  b4be4dd9b085ff32b35e9374254ba530N.exe
- Size
  
  394KB
- MD5
  
  b4be4dd9b085ff32b35e9374254ba530
- SHA1
  
  22a4d1cdda00ab4ce9b67c04366eaef9be06d08f
- SHA256
  
  8868a7cc9adfec0c694a21b87cf43db6cbd5a8cc8a923b662d19b653a524124e
- SHA512
  
  301cc249310c06545bff12f5f0c60d0c051fde35834d9eb3c235b5f1374dfcb83e46fc74ee8ba02e22b78c281b90f61bed01107ebc39b65fa29eae19f810993c
- SSDEEP
  
  6144:38ASJKenie2xT2NU2OTFQb8Fb0I1UfFmPGL:3A5nilTFQbI0a+GGL
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence