ec0cb4061924b830ffa7a30d14aa1bc78b98a690149146044a960848975a6196 | Triage

Sharing

General

Target

ec0cb4061924b830ffa7a30d14aa1bc78b98a690149146044a960848975a6196
Size

334KB
Sample

221001-yjyk8sdac3
MD5

6dc25eab41ac2eb9335f73cd0489c1d6
SHA1

3c2f2bef6b77ab389b397ee0bb45d7d3203b3286
SHA256

ec0cb4061924b830ffa7a30d14aa1bc78b98a690149146044a960848975a6196
SHA512

6b31408a4c58189f5544be563ff1b5e0854e21d5e765727261b5093490c3e2ec3e3c9b6aeeb61b23a516f54bdee5925b081b1a90b23bc81690b342ee869f8f57
SSDEEP

6144:1d0PTrTrlgqRRGLUlDjn066E6anSXDExK4HnuNctuBYlI2NFovXYpV2odmLdYU7T:mlgqRRGLUlDjn0Q2HLyURFGiDOGCG95B

Score

8^/10

microsoft persistence phishing

Malware Config

Targets

- Target
  
  ec0cb4061924b830ffa7a30d14aa1bc78b98a690149146044a960848975a6196
- Size
  
  334KB
- MD5
  
  6dc25eab41ac2eb9335f73cd0489c1d6
- SHA1
  
  3c2f2bef6b77ab389b397ee0bb45d7d3203b3286
- SHA256
  
  ec0cb4061924b830ffa7a30d14aa1bc78b98a690149146044a960848975a6196
- SHA512
  
  6b31408a4c58189f5544be563ff1b5e0854e21d5e765727261b5093490c3e2ec3e3c9b6aeeb61b23a516f54bdee5925b081b1a90b23bc81690b342ee869f8f57
- SSDEEP
  
  6144:1d0PTrTrlgqRRGLUlDjn066E6anSXDExK4HnuNctuBYlI2NFovXYpV2odmLdYU7T:mlgqRRGLUlDjn0Q2HLyURFGiDOGCG95B
Score

8^/10

microsoft persistence phishing
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

microsoftpersistencephishing