012e60b44219e9aa3c477f29490346ecc592acc69fbe91aaa172c8206d9e1c15 | Triage

Sharing

General

Target

012e60b44219e9aa3c477f29490346ecc592acc69fbe91aaa172c8206d9e1c15
Size

7.4MB
Sample

241203-t2jgtaypcr
MD5

8d59ea7c3e75a7efe77835e6b2805523
SHA1

920507c802716d4fe9e42f3a524b7d79de74f890
SHA256

012e60b44219e9aa3c477f29490346ecc592acc69fbe91aaa172c8206d9e1c15
SHA512

bb3b46e86a96ca6ef785468045aa4449029eac221a65a583c39a6374e6bb2816cf547863bd99dc9923d8c310be2908ea2c704d1583f4ba375cddeadabbfceeff
SSDEEP

196608:5WX+phJYDNAHmXiqKmqQeyLKpRdcVtXEXnV:5XjqDNAGXiTmrMpwVVCV

Score

8^/10

defense_evasion discovery evasion execution persistence

Malware Config

Targets

- Target
  
  012e60b44219e9aa3c477f29490346ecc592acc69fbe91aaa172c8206d9e1c15
- Size
  
  7.4MB
- MD5
  
  8d59ea7c3e75a7efe77835e6b2805523
- SHA1
  
  920507c802716d4fe9e42f3a524b7d79de74f890
- SHA256
  
  012e60b44219e9aa3c477f29490346ecc592acc69fbe91aaa172c8206d9e1c15
- SHA512
  
  bb3b46e86a96ca6ef785468045aa4449029eac221a65a583c39a6374e6bb2816cf547863bd99dc9923d8c310be2908ea2c704d1583f4ba375cddeadabbfceeff
- SSDEEP
  
  196608:5WX+phJYDNAHmXiqKmqQeyLKpRdcVtXEXnV:5XjqDNAGXiTmrMpwVVCV
Score

8^/10

defense_evasion discovery evasion execution persistence
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Indicator Removal

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionpersistence

behavioral2

defense_evasiondiscoveryevasionexecutionpersistence