c5891b8876a8dd8d2383d93028f594f877bae14f62a66f1c8a18f1cfba29adf9 | Triage

Sharing

General

Target

c5891b8876a8dd8d2383d93028f594f877bae14f62a66f1c8a18f1cfba29adf9N.exe
Size

624KB
Sample

241120-eh3c9avpbm
MD5

469e65a0f11d8754ce070fff101456c0
SHA1

c01144e95b1b912899aab0045ae65d9a08e9c7a0
SHA256

c5891b8876a8dd8d2383d93028f594f877bae14f62a66f1c8a18f1cfba29adf9
SHA512

df61fd0d2066b39b67372cb8cd18f191bbb929fcb7f7548758f42aaaf3165ec5ddfe3d63f4684312c80915cc3897338a3b35be1ba6393e687c5b0dc8ada14f5e
SSDEEP

12288:6MdUFRTEJcwQQJFs0mib/Sp2UC+Am8hnbI3fnW1L6Jxs2zi9oXJ8:1UFS6HibQA/NbUfnW1W3sQi9oXJ8

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  c5891b8876a8dd8d2383d93028f594f877bae14f62a66f1c8a18f1cfba29adf9N.exe
- Size
  
  624KB
- MD5
  
  469e65a0f11d8754ce070fff101456c0
- SHA1
  
  c01144e95b1b912899aab0045ae65d9a08e9c7a0
- SHA256
  
  c5891b8876a8dd8d2383d93028f594f877bae14f62a66f1c8a18f1cfba29adf9
- SHA512
  
  df61fd0d2066b39b67372cb8cd18f191bbb929fcb7f7548758f42aaaf3165ec5ddfe3d63f4684312c80915cc3897338a3b35be1ba6393e687c5b0dc8ada14f5e
- SSDEEP
  
  12288:6MdUFRTEJcwQQJFs0mib/Sp2UC+Am8hnbI3fnW1L6Jxs2zi9oXJ8:1UFS6HibQA/NbUfnW1W3sQi9oXJ8
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasion