9d80c28aed0377e9a4ef9a31177aa36f5fdf574d86d6bc7f85f30980c8257b1a | Triage

Sharing

General

Target

9d80c28aed0377e9a4ef9a31177aa36f5fdf574d86d6bc7f85f30980c8257b1a
Size

32KB
Sample

220919-x9xaesecb3
MD5

df0c310d4be0222791cd9461cad3fbb8
SHA1

e162df913ba68526c27252ffa19ff33549ab73bb
SHA256

9d80c28aed0377e9a4ef9a31177aa36f5fdf574d86d6bc7f85f30980c8257b1a
SHA512

fad4055a8d667d4866c8d4f4cb99086a3a8e3d2f60c1f60c7308e953b027afc4f1896d28b4ec039ea726986327fa7b14452e928ab37139c98600e53f1dd2e4b2
SSDEEP

192:xW+vmKC06EoThVyXaQV8O4f9GeVMzkjoNJXRRwS6mKskxU4y:xW+vmKZ6piK4W91Mzk6XPwS4rxU4y

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  9d80c28aed0377e9a4ef9a31177aa36f5fdf574d86d6bc7f85f30980c8257b1a
- Size
  
  32KB
- MD5
  
  df0c310d4be0222791cd9461cad3fbb8
- SHA1
  
  e162df913ba68526c27252ffa19ff33549ab73bb
- SHA256
  
  9d80c28aed0377e9a4ef9a31177aa36f5fdf574d86d6bc7f85f30980c8257b1a
- SHA512
  
  fad4055a8d667d4866c8d4f4cb99086a3a8e3d2f60c1f60c7308e953b027afc4f1896d28b4ec039ea726986327fa7b14452e928ab37139c98600e53f1dd2e4b2
- SSDEEP
  
  192:xW+vmKC06EoThVyXaQV8O4f9GeVMzkjoNJXRRwS6mKskxU4y:xW+vmKZ6piK4W91Mzk6XPwS4rxU4y
Score

8^/10

evasion persistence
- Looks for VMWare Tools registry key
  evasion
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence