91d241ab7ea2dd9bfeaa0f5f00c5dab2e9125c34ebdf6d9e916f1185faba1474 | Triage

Sharing

General

Target

91d241ab7ea2dd9bfeaa0f5f00c5dab2e9125c34ebdf6d9e916f1185faba1474N
Size

127KB
Sample

240920-hsh9xatfmh
MD5

8bc3e577f58b1c3c1749427fb2a13d40
SHA1

bc7cad2ea21188e7b9537558d9b23ddd918d935e
SHA256

91d241ab7ea2dd9bfeaa0f5f00c5dab2e9125c34ebdf6d9e916f1185faba1474
SHA512

eee86a9bcace2c108e7d654e8d1e0a0bb0008302b4b719e77f88a6ce0fe2694764eb86c0036670aae9c09cb83d0638514cb0d20f3c3a5d0fb0b6569b9b933b97
SSDEEP

1536:dYEz4wRKbRuBxLDtVdHa27J14lWxporZ45igpNeGE:6Ez4wRykLt6gJ1uPt45VC

Score

10^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  91d241ab7ea2dd9bfeaa0f5f00c5dab2e9125c34ebdf6d9e916f1185faba1474N
- Size
  
  127KB
- MD5
  
  8bc3e577f58b1c3c1749427fb2a13d40
- SHA1
  
  bc7cad2ea21188e7b9537558d9b23ddd918d935e
- SHA256
  
  91d241ab7ea2dd9bfeaa0f5f00c5dab2e9125c34ebdf6d9e916f1185faba1474
- SHA512
  
  eee86a9bcace2c108e7d654e8d1e0a0bb0008302b4b719e77f88a6ce0fe2694764eb86c0036670aae9c09cb83d0638514cb0d20f3c3a5d0fb0b6569b9b933b97
- SSDEEP
  
  1536:dYEz4wRKbRuBxLDtVdHa27J14lWxporZ45igpNeGE:6Ez4wRykLt6gJ1uPt45VC
Score

10^/10

discovery evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence

behavioral2

discoveryevasionpersistence