Overview

overview

6

Static

static

5f8e7c1b4f...08.exe

windows7-x64

5

5f8e7c1b4f...08.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308

  • Size

    2MB

  • Sample

    221002-sxlwpseahm

  • MD5

    656436ec2c07053b199a19730a74283d

  • SHA1

    ff2b556a5fa2f0c1de17698a52fde3589607877b

  • SHA256

    5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308

  • SHA512

    07337ac7fcc5529a99b52c97facf554f61a9483ee40d8ca5375607858111b1abd1f10dab66cbf4829d3f9308925267429fb1285e9434d3f65658927151906c03

  • SSDEEP

    24576:IlVCxwY7fti7Hb3Z4e4VtHvtftQih8ESwSMP3/R6pjl:IlMw6tij+eGHhtQiqZjyRSJ

Score
6/10
microsoftpersistencephishing

Malware Config

Targets

    • Target

      5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308

    • Size

      2MB

    • MD5

      656436ec2c07053b199a19730a74283d

    • SHA1

      ff2b556a5fa2f0c1de17698a52fde3589607877b

    • SHA256

      5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308

    • SHA512

      07337ac7fcc5529a99b52c97facf554f61a9483ee40d8ca5375607858111b1abd1f10dab66cbf4829d3f9308925267429fb1285e9434d3f65658927151906c03

    • SSDEEP

      24576:IlVCxwY7fti7Hb3Z4e4VtHvtftQih8ESwSMP3/R6pjl:IlMw6tij+eGHhtQiqZjyRSJ

    Score
    6/10
    microsoftpersistencephishing

    • Adds Run key to start application

      persistence

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Tasks