6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc | Triage

Sharing

General

Target

6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc
Size

3.8MB
Sample

201112-ncbgs7nxs6
MD5

d050bf835cb8a5267754e565cfb75a3a
SHA1

c295f051e7e06717326b4bb98bce41d0ef8b4f5d
SHA256

6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc
SHA512

fe1e2dd16b759223dd271597d10c987ba8a3f42966db96948ece963f769d381ef6874fe5597d3d7a7e3799760db9909d5025765ca6cf488cae9e06908c960fd9

Score

9^/10

discovery exploit persistence

Malware Config

Targets

- Target
  
  6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc
- Size
  
  3.8MB
- MD5
  
  d050bf835cb8a5267754e565cfb75a3a
- SHA1
  
  c295f051e7e06717326b4bb98bce41d0ef8b4f5d
- SHA256
  
  6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc
- SHA512
  
  fe1e2dd16b759223dd271597d10c987ba8a3f42966db96948ece963f769d381ef6874fe5597d3d7a7e3799760db9909d5025765ca6cf488cae9e06908c960fd9
Score

9^/10

discovery exploit persistence
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Sets DLL path for service in the registry
  persistence
- Deletes itself
- Modifies file permissions
  discovery
- Drops file in System32 directory
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

Registry Run Keys / Startup Folder

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

File Permissions Modification

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoveryexploitpersistence

behavioral2