633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5 | Triage

Sharing

General

Target

633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5
Size

3.8MB
Sample

240817-3rwttstfpa
MD5

a6626b71acfb1b02c3701ff6d9488150
SHA1

470c0846b790506728c9dc4c5616e3cc79e7103d
SHA256

633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5
SHA512

60d5ca672277bf55a648059fd6bdf75fd4c5f29b19795befc7ff7495dac1bdf0694b04c36c4adbdc1190b7bef9cf7734da803599829c890f035ab6a8bac8e735
SSDEEP

49152:1fs6Ds61AsNHyva6SRw62VBzCGPJ+kOWIFa2XWI1q+GUWI1q+GdWIbqqDpWIba2s:FswsUHysR+VB2GPJ+k6R+VB2GPJM

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5
- Size
  
  3.8MB
- MD5
  
  a6626b71acfb1b02c3701ff6d9488150
- SHA1
  
  470c0846b790506728c9dc4c5616e3cc79e7103d
- SHA256
  
  633a1bbf4b13bec3b54b3e838b14b75cd2b978bf44dc08567637d3d081e274e5
- SHA512
  
  60d5ca672277bf55a648059fd6bdf75fd4c5f29b19795befc7ff7495dac1bdf0694b04c36c4adbdc1190b7bef9cf7734da803599829c890f035ab6a8bac8e735
- SSDEEP
  
  49152:1fs6Ds61AsNHyva6SRw62VBzCGPJ+kOWIFa2XWI1q+GUWI1q+GdWIbqqDpWIba2s:FswsUHysR+VB2GPJ+k6R+VB2GPJM
Score

10^/10

discovery evasion persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence