12f18b96e16f6d4b3f839eaa13f45aa0c477a4435a6ba74b1dd7ce1d4f9b5c88 | Triage

Sharing

General

Target

ae9eb052fcef5c2d53f2d6e458877ed0N.exe
Size

84KB
Sample

240829-qd79gsvepm
MD5

ae9eb052fcef5c2d53f2d6e458877ed0
SHA1

6e5eb32ef40105e17cfe73c76d0a4e3f49dd911b
SHA256

12f18b96e16f6d4b3f839eaa13f45aa0c477a4435a6ba74b1dd7ce1d4f9b5c88
SHA512

505b623aae16ca55966c40d4e3bffc3fe1d4576c7e31a8cbe896f9c02197454942a6cebe073204e9ba30684ed2f6365a203ba1060d5a6bf920f4cb2c164963cf
SSDEEP

768:wjCvD2eMLPbIryoShe+rzVRD2s5HcwHD0wg8hwPrL8O4d94deoVDAADY4BO0BvXu:wqDPyw+rzz3JpgfvXx4

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  ae9eb052fcef5c2d53f2d6e458877ed0N.exe
- Size
  
  84KB
- MD5
  
  ae9eb052fcef5c2d53f2d6e458877ed0
- SHA1
  
  6e5eb32ef40105e17cfe73c76d0a4e3f49dd911b
- SHA256
  
  12f18b96e16f6d4b3f839eaa13f45aa0c477a4435a6ba74b1dd7ce1d4f9b5c88
- SHA512
  
  505b623aae16ca55966c40d4e3bffc3fe1d4576c7e31a8cbe896f9c02197454942a6cebe073204e9ba30684ed2f6365a203ba1060d5a6bf920f4cb2c164963cf
- SSDEEP
  
  768:wjCvD2eMLPbIryoShe+rzVRD2s5HcwHD0wg8hwPrL8O4d94deoVDAADY4BO0BvXu:wqDPyw+rzz3JpgfvXx4
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence