0ef0fbb421d59cfe86cb2d50c01649c3135b011085528c319dd229f32acc3f4e | Triage

Sharing

General

Target

0ef0fbb421d59cfe86cb2d50c01649c3135b011085528c319dd229f32acc3f4eN
Size

137KB
Sample

241023-s98k8sybje
MD5

52aca881f673c6addcd9b9ddb989fba0
SHA1

0a8dd50f4a5c3bd7e5b67ec83f15d45ba86f39de
SHA256

0ef0fbb421d59cfe86cb2d50c01649c3135b011085528c319dd229f32acc3f4e
SHA512

f7e27b4a091f05b14c2d0af02a40b305290dfaff2136dd3d06407eeaca153996529a2bf69d202445b4c49652fa754811783d1afc4f1ee3fb3bc35a04efb6fc67
SSDEEP

3072:51i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU8T:7i/NjO5x0Xg+UGSYnuy3Oai/Nr

Score

8^/10

defense_evasion discovery persistence

Malware Config

Targets

- Target
  
  0ef0fbb421d59cfe86cb2d50c01649c3135b011085528c319dd229f32acc3f4eN
- Size
  
  137KB
- MD5
  
  52aca881f673c6addcd9b9ddb989fba0
- SHA1
  
  0a8dd50f4a5c3bd7e5b67ec83f15d45ba86f39de
- SHA256
  
  0ef0fbb421d59cfe86cb2d50c01649c3135b011085528c319dd229f32acc3f4e
- SHA512
  
  f7e27b4a091f05b14c2d0af02a40b305290dfaff2136dd3d06407eeaca153996529a2bf69d202445b4c49652fa754811783d1afc4f1ee3fb3bc35a04efb6fc67
- SSDEEP
  
  3072:51i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU8T:7i/NjO5x0Xg+UGSYnuy3Oai/Nr
Score

8^/10

defense_evasion discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence