a2b9608a8b28505b5b9c4ba3a7106940abb4668480c02989e4f9e5458d99745a | Triage

Sharing

General

Target

a2b9608a8b28505b5b9c4ba3a7106940abb4668480c02989e4f9e5458d99745aN
Size

37KB
Sample

240919-gvqakathnb
MD5

06d2f6a762a9c13e5cf8e5af06c7e060
SHA1

83ce8f80f64265d996ebec278672dd9a085100db
SHA256

a2b9608a8b28505b5b9c4ba3a7106940abb4668480c02989e4f9e5458d99745a
SHA512

8a7c8571f24add3df8aa88c6cd7caa2d2446d4e7c3ebca1ab21e159c9cf65795a9dcf369a8492db7f4ac48feffdaf5da0a01729c7fda1bc2ead81102b7eadc27
SSDEEP

768:b8kr2D6AKlLO+SNhBgCHDck4MV0ggv8KoETBB9D3xvjHhx4eC7Xj8Qc1J9:Y/6A0q5HDR4oWBx3xrBx41z8QcX9

Score

7^/10

defense_evasion discovery

Malware Config

Targets

- Target
  
  a2b9608a8b28505b5b9c4ba3a7106940abb4668480c02989e4f9e5458d99745aN
- Size
  
  37KB
- MD5
  
  06d2f6a762a9c13e5cf8e5af06c7e060
- SHA1
  
  83ce8f80f64265d996ebec278672dd9a085100db
- SHA256
  
  a2b9608a8b28505b5b9c4ba3a7106940abb4668480c02989e4f9e5458d99745a
- SHA512
  
  8a7c8571f24add3df8aa88c6cd7caa2d2446d4e7c3ebca1ab21e159c9cf65795a9dcf369a8492db7f4ac48feffdaf5da0a01729c7fda1bc2ead81102b7eadc27
- SSDEEP
  
  768:b8kr2D6AKlLO+SNhBgCHDck4MV0ggv8KoETBB9D3xvjHhx4eC7Xj8Qc1J9:Y/6A0q5HDR4oWBx3xrBx41z8QcX9
Score

7^/10

defense_evasion discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Safe Mode Boot

Subvert Trust Controls

SIP and Trust Provider Hijacking

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery

behavioral2

defense_evasiondiscovery