dc1982b083f3629e55d3bc6a057487c492a70eca3deb9306b30caf70090b9f8c | Triage

Sharing

General

Target

SKv1101015.msi
Size

1.4MB
Sample

220404-e3gx2sehfm
MD5

58322cc0d504de7b8c105a1ad4835819
SHA1

a3eacab0d427be9c962d86e93c04cd59d6dc65af
SHA256

dc1982b083f3629e55d3bc6a057487c492a70eca3deb9306b30caf70090b9f8c
SHA512

498a6f2a4a5c18d6ef39e3ef903309507f463a74a8c1a7b67352c68a0986e17b020b779c26cb69b10cc199ced1f112ba054d118f0bec404301b0a63ee0ec9d2a

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  SKv1101015.msi
- Size
  
  1.4MB
- MD5
  
  58322cc0d504de7b8c105a1ad4835819
- SHA1
  
  a3eacab0d427be9c962d86e93c04cd59d6dc65af
- SHA256
  
  dc1982b083f3629e55d3bc6a057487c492a70eca3deb9306b30caf70090b9f8c
- SHA512
  
  498a6f2a4a5c18d6ef39e3ef903309507f463a74a8c1a7b67352c68a0986e17b020b779c26cb69b10cc199ced1f112ba054d118f0bec404301b0a63ee0ec9d2a
Score

8^/10

persistence
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2