f444a8d3170710a908aceb7f940170027e901334c7283905a8bd316bc54b8835 | Triage

Sharing

General

Target

CRforVS13SP29_0-10010309.EXE
Size

374.6MB
Sample

240928-mpc1yatdnd
MD5

cf2c10349b9a91c62a71116babcf9524
SHA1

986ce6a9718e2762f385dcf50f9de34a9bd2e498
SHA256

f444a8d3170710a908aceb7f940170027e901334c7283905a8bd316bc54b8835
SHA512

6c642e6f4a3709a72fb7eabb38d8033a0f8442944c2fbb8c3e8eb620833e6aaf0b0b5448e112c49952ae379373432c5241415faf61e20acf9b2b9b43a9dae630
SSDEEP

6291456:jiWTNdWXEbLnxByxO+aE3F8fZB+3I2TXnu8YyAzrzsnlYAI770omn0FHBxoRA0wM:OWTNdWcxcxh3FQN27nunzsnCXG0FhxoP

Score

7^/10

discovery

Malware Config

Targets

- Target
  
  CRforVS13SP29_0-10010309.EXE
- Size
  
  374.6MB
- MD5
  
  cf2c10349b9a91c62a71116babcf9524
- SHA1
  
  986ce6a9718e2762f385dcf50f9de34a9bd2e498
- SHA256
  
  f444a8d3170710a908aceb7f940170027e901334c7283905a8bd316bc54b8835
- SHA512
  
  6c642e6f4a3709a72fb7eabb38d8033a0f8442944c2fbb8c3e8eb620833e6aaf0b0b5448e112c49952ae379373432c5241415faf61e20acf9b2b9b43a9dae630
- SSDEEP
  
  6291456:jiWTNdWXEbLnxByxO+aE3F8fZB+3I2TXnu8YyAzrzsnlYAI770omn0FHBxoRA0wM:OWTNdWcxcxh3FQN27nunzsnCXG0FhxoP
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2