b8f3f2b85c6ea1a103209d250906d5a3ddadcfc41cb82c959792ff5cb5f1e663 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b8f3f2b85c6ea1a103209d250906d5a3ddadcfc41cb82c959792ff5cb5f1e663
Size

184KB
Sample

221019-1qtxqsabcp
MD5

a1b71b4d6b8d0cd1e14e60c9b86de65a
SHA1

c46748a856b091013f0ee1372cbe5d55f9e2c63a
SHA256

b8f3f2b85c6ea1a103209d250906d5a3ddadcfc41cb82c959792ff5cb5f1e663
SHA512

02642200033eb1b6cb4af4a19981d2eeb5b56b952aa3eae7969e2351273404fc57de3236b46927ded847b150732361a4061694dd64af7e2350d3d2c78a59e790
SSDEEP

3072:gj7xftDmyl76T6oEC0wnw9qiJYgqaoX4+6sPekI9FtBYoLAlqNUw9t4:4/myesqiJYnaC4yP4rzUws

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  b8f3f2b85c6ea1a103209d250906d5a3ddadcfc41cb82c959792ff5cb5f1e663
- Size
  
  184KB
- MD5
  
  a1b71b4d6b8d0cd1e14e60c9b86de65a
- SHA1
  
  c46748a856b091013f0ee1372cbe5d55f9e2c63a
- SHA256
  
  b8f3f2b85c6ea1a103209d250906d5a3ddadcfc41cb82c959792ff5cb5f1e663
- SHA512
  
  02642200033eb1b6cb4af4a19981d2eeb5b56b952aa3eae7969e2351273404fc57de3236b46927ded847b150732361a4061694dd64af7e2350d3d2c78a59e790
- SSDEEP
  
  3072:gj7xftDmyl76T6oEC0wnw9qiJYgqaoX4+6sPekI9FtBYoLAlqNUw9t4:4/myesqiJYnaC4yP4rzUws
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2