92056e7b19a7f59ea53482f7d5d6f1a4d9320d71d2422f906c6fcf46b85f6fcd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

92056e7b19a7f59ea53482f7d5d6f1a4d9320d71d2422f906c6fcf46b85f6fcd.msi
Size

9.2MB
Sample

240728-bvc3catbne
MD5

5745d7cc8d45b0a4f2a453462312cdcf
SHA1

0fef4497555f949022e8f71dd649f425bbfc331b
SHA256

92056e7b19a7f59ea53482f7d5d6f1a4d9320d71d2422f906c6fcf46b85f6fcd
SHA512

15a297d25e53146cc2404d8700552d377e2514aa98a63d8b124795f697a54da937b7de7ecbd9c2bb112b0d8fdd46b991178c8cb632219d3b3623707ccc492489
SSDEEP

49152:rqYOtB7WHgVI0g6Tbrz5io+HGGWxyzPlrXVVdWpA11V7RWypBqZdQwOh+yH/mUl+:rqYe7W9GGWQlGAdydQwKHS

Score

8^/10

discovery evasion execution persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  92056e7b19a7f59ea53482f7d5d6f1a4d9320d71d2422f906c6fcf46b85f6fcd.msi
- Size
  
  9.2MB
- MD5
  
  5745d7cc8d45b0a4f2a453462312cdcf
- SHA1
  
  0fef4497555f949022e8f71dd649f425bbfc331b
- SHA256
  
  92056e7b19a7f59ea53482f7d5d6f1a4d9320d71d2422f906c6fcf46b85f6fcd
- SHA512
  
  15a297d25e53146cc2404d8700552d377e2514aa98a63d8b124795f697a54da937b7de7ecbd9c2bb112b0d8fdd46b991178c8cb632219d3b3623707ccc492489
- SSDEEP
  
  49152:rqYOtB7WHgVI0g6Tbrz5io+HGGWxyzPlrXVVdWpA11V7RWypBqZdQwOh+yH/mUl+:rqYe7W9GGWQlGAdydQwKHS
Score

8^/10

discovery evasion execution persistence privilege_escalation trojan
- Blocklisted process makes network request
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Event Triggered Execution

Installer Packages

Privilege Escalation

Event Triggered Execution

Installer Packages

Defense Evasion

Modify Registry

System Binary Proxy Execution

Msiexec

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionexecutionpersistenceprivilege_escalationtrojan

behavioral2

discoveryexecutionpersistenceprivilege_escalation