409175e4c97e6f99a9c17890fbd398c7ccfb3cb7b7a1c4a5a08f438e9bf411bb | Triage

Sharing

General

Target

409175e4c97e6f99a9c17890fbd398c7ccfb3cb7b7a1c4a5a08f438e9bf411bb
Size

143KB
Sample

221003-bq2vxaadg5
MD5

0785e862874f8bb53c7477a363b9ebe7
SHA1

20212dea8c6872f58ae3716507265f717883fddd
SHA256

409175e4c97e6f99a9c17890fbd398c7ccfb3cb7b7a1c4a5a08f438e9bf411bb
SHA512

c0bcbcc68902e64051ad918a23278cefbd6201ab2526fb68685f33b6b636b178e0abf3e538015b58c005c19f89176456669846b5ec800273cc352cd8f6b08d7a
SSDEEP

3072:Ajb3DfTjOg5lFMNVNkDHAf+aP0mSG+HQ6SdJVHoVxW24hg+Y:M3yg3MNADAfOc3+V1yz

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  409175e4c97e6f99a9c17890fbd398c7ccfb3cb7b7a1c4a5a08f438e9bf411bb
- Size
  
  143KB
- MD5
  
  0785e862874f8bb53c7477a363b9ebe7
- SHA1
  
  20212dea8c6872f58ae3716507265f717883fddd
- SHA256
  
  409175e4c97e6f99a9c17890fbd398c7ccfb3cb7b7a1c4a5a08f438e9bf411bb
- SHA512
  
  c0bcbcc68902e64051ad918a23278cefbd6201ab2526fb68685f33b6b636b178e0abf3e538015b58c005c19f89176456669846b5ec800273cc352cd8f6b08d7a
- SSDEEP
  
  3072:Ajb3DfTjOg5lFMNVNkDHAf+aP0mSG+HQ6SdJVHoVxW24hg+Y:M3yg3MNADAfOc3+V1yz
Score

8^/10

persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2