939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd | Triage

Sharing

General

Target

939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd
Size

388KB
Sample

240808-a8w7ps1bpc
MD5

437061eecf8e0d4a5882238aa581b9e9
SHA1

441f22d0835170fcffa8da65e7a035c229b6e315
SHA256

939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd
SHA512

4e52228ac20d3d685de0bf6bf439d4ef8996bb36d1adc9820de11ecb3200fb5119dd018f7456cf80575d1e4992219343f7d7084c905f73c2ae27efd5f5670b02
SSDEEP

12288:R2iNY2iNY2iNY2iNY2iNY2iNY2iNY2iNF+pABsJ:R1a1a1a1a1a1a1a1O

Score

8^/10

evasion persistence privilege_escalation

Malware Config

Targets

- Target
  
  939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd
- Size
  
  388KB
- MD5
  
  437061eecf8e0d4a5882238aa581b9e9
- SHA1
  
  441f22d0835170fcffa8da65e7a035c229b6e315
- SHA256
  
  939e2a50370e4f7e641f7db0415925294b4d9e6704c56abda3d7c3d000650ffd
- SHA512
  
  4e52228ac20d3d685de0bf6bf439d4ef8996bb36d1adc9820de11ecb3200fb5119dd018f7456cf80575d1e4992219343f7d7084c905f73c2ae27efd5f5670b02
- SSDEEP
  
  12288:R2iNY2iNY2iNY2iNY2iNY2iNY2iNY2iNF+pABsJ:R1a1a1a1a1a1a1a1O
Score

8^/10

evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalation

behavioral2

evasionpersistenceprivilege_escalation