f7a46a36557755b954141b8d61893ff475b217171b696cf305bc03ec319bcd16 | Triage

Sharing

General

Target

2024-09-05_98ce8b1f4cbab8f928ab14218d6644f3_lockbit
Size

39KB
Sample

240905-pc961s1elb
MD5

98ce8b1f4cbab8f928ab14218d6644f3
SHA1

8d87e9cf4f24c2f350b66621483e78e7aa7dd329
SHA256

f7a46a36557755b954141b8d61893ff475b217171b696cf305bc03ec319bcd16
SHA512

907b3230fcf985b8c4565748ee76fa5b1071e0a7c8989e810f5d793eaee4aed39d19fe7e260136ebccb3cc74e910606a8486d07f460925b2d89a9c69f3dc198a
SSDEEP

768:9Ef/gFsuJmTvK5AxGfM2lvpTSzyBsYw/B8MSyg5S4g8a/3x58evKEYWmVjj5uAz/:if/zuJmTn2lvpSzyOvBWg8g3xeevKE2t

Score

7^/10

defense_evasion discovery

Malware Config

Targets

- Target
  
  2024-09-05_98ce8b1f4cbab8f928ab14218d6644f3_lockbit
- Size
  
  39KB
- MD5
  
  98ce8b1f4cbab8f928ab14218d6644f3
- SHA1
  
  8d87e9cf4f24c2f350b66621483e78e7aa7dd329
- SHA256
  
  f7a46a36557755b954141b8d61893ff475b217171b696cf305bc03ec319bcd16
- SHA512
  
  907b3230fcf985b8c4565748ee76fa5b1071e0a7c8989e810f5d793eaee4aed39d19fe7e260136ebccb3cc74e910606a8486d07f460925b2d89a9c69f3dc198a
- SSDEEP
  
  768:9Ef/gFsuJmTvK5AxGfM2lvpTSzyBsYw/B8MSyg5S4g8a/3x58evKEYWmVjj5uAz/:if/zuJmTn2lvpSzyOvBWg8g3xeevKE2t
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Safe Mode Boot

Subvert Trust Controls

SIP and Trust Provider Hijacking

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery

behavioral2

defense_evasiondiscovery