1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08 | Triage

Sharing

General

Target

1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
Size

137KB
Sample

250111-hhrhjasjgm
MD5

21640f9330847c3ad96d1736bdf66840
SHA1

f8b6673a387641d14b71cd56680326b049f23214
SHA256

1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08
SHA512

cf5b5961e0b9bc0723b71e750f551ca17a5b0c9ab8dad2e42f573c0bf34af81309c95d2ecd9b290427efbf7313caa714f10c804e134f10f5ac42844525b9e752
SSDEEP

3072:11i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU8T:ni/NjO5x0Xg+UGSYnuy3Oai/Nr

Score

8^/10

defense_evasion discovery persistence

Malware Config

Targets

- Target
  
  1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08N.exe
- Size
  
  137KB
- MD5
  
  21640f9330847c3ad96d1736bdf66840
- SHA1
  
  f8b6673a387641d14b71cd56680326b049f23214
- SHA256
  
  1cf2133dd20051845e4feaea1d4dad15931a544398ddd7e3879b13627be90b08
- SHA512
  
  cf5b5961e0b9bc0723b71e750f551ca17a5b0c9ab8dad2e42f573c0bf34af81309c95d2ecd9b290427efbf7313caa714f10c804e134f10f5ac42844525b9e752
- SSDEEP
  
  3072:11i/NU8bOMYcYYcmy5d048g3nan3vx9kGSYng7+s5YmMOMYcYY51i/NU8T:ni/NjO5x0Xg+UGSYnuy3Oai/Nr
Score

8^/10

defense_evasion discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistence

behavioral2

defense_evasiondiscoverypersistence