7ca7e9637e56f7d5883101431aca07940eefbace64f6151736282eec3620d26e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7ca7e9637e56f7d5883101431aca07940eefbace64f6151736282eec3620d26e
Size

202KB
Sample

221003-tftqnadhem
MD5

566269d571d750200d42eb6e80180a02
SHA1

6e873854c23a07ae833bd625f4ea4469ee542ed5
SHA256

7ca7e9637e56f7d5883101431aca07940eefbace64f6151736282eec3620d26e
SHA512

4d72f2256cf7889da11fd666417bca7b79ea2d87bfeed1182bb8cfe4c5a8b466c75462a007d9092a45eac85155b9c2cbc1d1b9fbb720f89a74c1a806c5e80f56
SSDEEP

3072:AAuD3tv/afo8iMRs/yHGWl5N4xKgaCPdy4b2PE/OTIFfIFxR9eWVOsMvfNkKuD/G:AlJ/aA8oymWx7CPAXEWsNM9eps6WpzG

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  7ca7e9637e56f7d5883101431aca07940eefbace64f6151736282eec3620d26e
- Size
  
  202KB
- MD5
  
  566269d571d750200d42eb6e80180a02
- SHA1
  
  6e873854c23a07ae833bd625f4ea4469ee542ed5
- SHA256
  
  7ca7e9637e56f7d5883101431aca07940eefbace64f6151736282eec3620d26e
- SHA512
  
  4d72f2256cf7889da11fd666417bca7b79ea2d87bfeed1182bb8cfe4c5a8b466c75462a007d9092a45eac85155b9c2cbc1d1b9fbb720f89a74c1a806c5e80f56
- SSDEEP
  
  3072:AAuD3tv/afo8iMRs/yHGWl5N4xKgaCPdy4b2PE/OTIFfIFxR9eWVOsMvfNkKuD/G:AlJ/aA8oymWx7CPAXEWsNM9eps6WpzG
Score

10^/10

evasion persistence
- Modifies security service
  evasion
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2