7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984 | Triage

Sharing

General

Target

FakeActivation.zip
Size

275KB
Sample

240914-tcknkssamk
MD5

6db8a7da4e8dc527d445b7a37d02d5d6
SHA1

4fcc7cff8b49a834858d8c6016c3c6f109c9c794
SHA256

7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984
SHA512

b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718
SSDEEP

6144:slA1Q2B6SIHODfBeO6706bWyFyA3tvZqfgP6mJJtkvnBM1KgHWR:iCQ2B3IHO1e3WeGoHJJtkvnBOi

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  FakeActivation.zip
- Size
  
  275KB
- MD5
  
  6db8a7da4e8dc527d445b7a37d02d5d6
- SHA1
  
  4fcc7cff8b49a834858d8c6016c3c6f109c9c794
- SHA256
  
  7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984
- SHA512
  
  b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718
- SSDEEP
  
  6144:slA1Q2B6SIHODfBeO6706bWyFyA3tvZqfgP6mJJtkvnBM1KgHWR:iCQ2B3IHO1e3WeGoHJJtkvnBOi
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence