7b347a9267ef967f20817b4ef13026bc3ebcf07a2eecd5bc67c7dfdad0d62860 | Triage

Sharing

General

Target

7b347a9267ef967f20817b4ef13026bc3ebcf07a2eecd5bc67c7dfdad0d62860
Size

3.8MB
Sample

201109-9n72651s6x
MD5

00ae90dd7e86dc9f42dd6df84652122d
SHA1

ce09069c7a20d4ac0ce4169a27eab84d3d0e5fdf
SHA256

7b347a9267ef967f20817b4ef13026bc3ebcf07a2eecd5bc67c7dfdad0d62860
SHA512

835808a455f963ffb37bb7d3fabdf7f52f0435b1a4f2e4600148024c25657f4ab579f44c444239d118183365eb8e73820c52fabbf8cb4f49b9372f62633fdee5

Score

9^/10

discovery exploit persistence

Malware Config

Targets

- Target
  
  7b347a9267ef967f20817b4ef13026bc3ebcf07a2eecd5bc67c7dfdad0d62860
- Size
  
  3.8MB
- MD5
  
  00ae90dd7e86dc9f42dd6df84652122d
- SHA1
  
  ce09069c7a20d4ac0ce4169a27eab84d3d0e5fdf
- SHA256
  
  7b347a9267ef967f20817b4ef13026bc3ebcf07a2eecd5bc67c7dfdad0d62860
- SHA512
  
  835808a455f963ffb37bb7d3fabdf7f52f0435b1a4f2e4600148024c25657f4ab579f44c444239d118183365eb8e73820c52fabbf8cb4f49b9372f62633fdee5
Score

9^/10

discovery exploit persistence
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Sets DLL path for service in the registry
  persistence
- Deletes itself
- Modifies file permissions
  discovery
- Drops file in System32 directory
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

Registry Run Keys / Startup Folder

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

File Permissions Modification

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoveryexploitpersistence

behavioral2